# Security Controls and Control Overlays
**Entity class:** Security-engineering method
## Definition
**Security controls** are safeguards and countermeasures selected to manage information-system risk. A **control baseline** supplies an initial set; tailoring adjusts it; a **control overlay** applies additional or modified controls and parameter values for a technology, mission, environment, information type, or threat.
An overlay is therefore how a common control vocabulary becomes specialized without requiring a wholly separate security universe.
## Relationships
- **catalog:** [[wiki/NIST SP 800-53|NIST SP 800-53]].
- **lifecycle:** [[wiki/Risk Management Framework|Risk Management Framework]].
- **NSS implementation:** [[wiki/CNSSI 1253|CNSSI 1253]].
- **machine-executable objective:** [[wiki/Machine-Readable Assurance|Machine-Readable Assurance]].
## Sources / Provenance
- [NIST — SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)
- [NIST — SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final)