A team implementing an industry control framework is working through it as a checklist, implementing every control in order regardless of the organization's circumstances. What should the information security manager advise?
Select an answer to reveal the explanation.
Short Explanation
A framework is a recipe book, not a single recipe you must cook start to finish. You pick and adjust what fits your kitchen, meaning your risks and business, and you don't just cook every page in order.
Full Explanation
Control frameworks provide a structured catalog of good practices, but they are written for broad audiences and are intended to be applied with judgment. Effective use involves selecting and tailoring controls according to the organization's risk assessment, business objectives, regulatory obligations and existing environment, so that effort goes where it reduces meaningful risk and controls fit how the business operates. Implementing every control exactly as written treats the framework as a compliance checklist, which can waste resources on low-risk areas, delay controls for significant risks and produce controls that do not suit the environment. Starting with the cheapest controls produces an impression of progress, but order should follow risk priority rather than cost; inexpensive controls may address minor risks while serious gaps remain. Adopting a second framework adds more catalog material without fixing the underlying problem, which is the absence of risk-based selection; overlapping frameworks also add mapping and maintenance effort. Exam caveat: some regulations mandate specific controls, and those must be implemented regardless of tailoring, but tailoring still governs how. Operational check: confirm each implemented or excluded control has a documented rationale tied to the risk assessment.