Which task corresponds to Control Selection?

• A. Documentation of Planned Control Implementations
• B. Plan Review and Approval
• C. Control Selection
• D. Control Tailoring

Answer: (C)

The task being tested is the act of choosing which security controls will be used for the system. Control selection is about deciding which controls to implement from the available catalog, usually starting from a baseline and adjusting for the system’s impact level and risk. This is the step where you determine “what controls will be used,” not how they will be implemented or how the plan is reviewed. That’s why matching the task to control selection is the best fit.

Documentation of planned control implementations describes documenting how the chosen controls will be put in place, not the act of choosing them. Plan review and approval involves validating and authorizing the plan, which occurs after the controls are selected. Control tailoring involves modifying the selected baseline controls to fit the environment, which is related but focuses on adjustment rather than the initial selection itself.