Identify and validate control objectives

Based on your compliance requirements and risks identified from your threat model, derive and validate the control objectives and controls that you need to apply to your workload. Ongoing validation of control objectives and controls helps you measure the effectiveness of risk mitigation.

1. Derive control objectives from compliance requirements: Identify the necessary control objectives based on your specific regulatory, compliance, and governance requirements, such as GDPR, HIPAA, or PCI-DSS. These objectives should align with both industry standards and your internal policies.
2. Use the threat model to inform control objectives: Leverage your threat model to identify potential risks to your workload, and ensure that your control objectives are designed to mitigate those risks effectively.
3. Validate control objectives: Continuously validate that your control objectives are properly applied and remain effective over time. This involves regular testing and auditing to ensure that security measures are meeting the intended risk mitigation goals.
4. Ongoing monitoring and updates: Regularly review and update control objectives based on evolving threats, changes in compliance requirements, and updates in your workload environment. This ensures that the controls continue to provide adequate protection.
5. Measure the effectiveness of controls: Use automated tools and manual audits to measure the effectiveness of implemented controls. Assess whether the current risk mitigation strategies are sufficient or need adjustments.

Supporting Questions:

• What compliance requirements influence your control objectives?
• How does your threat model guide the selection of appropriate control objectives?
• What processes are in place to regularly validate and test control objectives?
• How do you measure the effectiveness of controls and make adjustments as necessary?

Roles and Responsibilities:

Compliance Officer:

• Responsibilities:
  • Ensure that control objectives meet compliance and regulatory standards.
  • Regularly review and update control objectives based on changing legal requirements.

Security Engineer:

• Responsibilities:
  • Derive control objectives from the threat model and compliance needs.
  • Implement and validate controls across the workload.
  • Monitor the effectiveness of controls and suggest improvements.

Artefacts:

• Control Objective Documentation: Records detailing the specific control objectives based on compliance and threat model requirements.
• Validation Reports: Regular audits and test results that show how control objectives are being applied and validated.
• Risk Mitigation Assessment: Reports measuring the effectiveness of current controls and recommendations for improvement where necessary.