# Security Controls and Control Overlays **Entity class:** Security-engineering method ## Definition **Security controls** are safeguards and countermeasures selected to manage information-system risk. A **control baseline** supplies an initial set; tailoring adjusts it; a **control overlay** applies additional or modified controls and parameter values for a technology, mission, environment, information type, or threat. An overlay is therefore how a common control vocabulary becomes specialized without requiring a wholly separate security universe. ## Relationships - **catalog:** [[wiki/NIST SP 800-53|NIST SP 800-53]]. - **lifecycle:** [[wiki/Risk Management Framework|Risk Management Framework]]. - **NSS implementation:** [[wiki/CNSSI 1253|CNSSI 1253]]. - **machine-executable objective:** [[wiki/Machine-Readable Assurance|Machine-Readable Assurance]]. ## Sources / Provenance - [NIST — SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - [NIST — SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final)