Documentation of planned control implementations is typically located in which documents?

• A. Controls and associated tailoring actions are documented in security and privacy plans or equivalent documents.
• B. Controls are documented only in incident reports.
• C. Documentation is optional.
• D. Documentation is stored in a separate risk registry.

Answer: (A)

Security and privacy plans or their equivalents are where the planned control implementations are captured. These documents specify which controls will be deployed, how they’re tailored to the organization, who is responsible, and the timelines and methods for implementation, testing, and ongoing monitoring. They serve as the authoritative reference for how the organization intends to meet security and privacy requirements and show how those choices align with applicable frameworks and regulations. Incident reports focus on events after they occur, not planned controls. Documentation isn’t optional in disciplined risk management, and while a risk registry may reference controls and treatments, it isn’t the primary place to describe the planned implementations and tailoring.