What it means
Tailoring can add, refine, scope, parameterize, or justify changes to controls while preserving traceability to the selected framework and risk assumptions.
Why it matters
A transparent tailoring process avoids both blind compliance and undocumented weakening of the control set.
Practical focus
- Start from the correct baseline and impact level
- Document scoping and parameter decisions
- Add overlays or enhancements for specific threats
- Record rationale, approval, and residual risk
Common mistakes
- Deleting controls without a risk-based explanation
- Treating the baseline as the final design
- Ignoring privacy or supply-chain requirements
- Using tailoring to hide implementation difficulty
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: