Lion Cipher Lab
Select and tailor a control baseline (NIST RMF Step 2)
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Categorizing a system tells you HOW MUCH protection it needs, but not WHICH protections. This is the step that turns 'Moderate impact' into an actual, defensible list of security controls — the thing every compliance program, every audit, and every System Security Plan is ultimately built on. Government systems must do this by law (FISMA), but the same move — start from a sensible baseline, then adjust it to your real system and write down why — is exactly how mature private-sector security programs decide what to implement instead of guessing. Get this step right and the rest of the…
What you'll learn
- NIST RMF Step 2 (Select)
- SP 800-53B control baselines
- control tailoring
- scoping and overlays
- documenting tailoring decisions
Steps in this lab
- Where this fits: the RMF, and the word 'control'
- Restate your input: the impact level you already decided
- Pick the matching baseline from SP 800-53B
- Know where the actual controls live: the SP 800-53 catalog
- Tailoring action 1 — apply any overlays
- Tailoring action 2 — scope the baseline to your real system
- Write the tailoring decision record
- Assemble the tailored control set and hand it forward
- Why this beats 'just install everything'