{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Governance, Policy & Oversight","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-16","description":"Select and document a baseline of security and privacy controls — including general controls over technology — responsive to assessed risks, and tailor it to the organization's environment, complexity, and risk appetite, considering an appropriate mix of preventive and detective control types and segregation of duties. Centrally identify, manage, and deploy common controls where appropriate, and document and approve the rationale for all tailoring decisions.","details":{"control_category":"administrative","control_type":"preventive","domain":"Governance, Policy & Oversight","guidance":[],"members":[{"control_id":"PL-10","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"PL-11","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"PL-9","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"CC5.1","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"CC5.2","coverage":"partial","delta":"developing and operating the specific technology general controls (infrastructure, security management, acquisition/development/maintenance) satisfied by dedicated ITGC companion controls; this UC delivers their selection into the baseline","framework":"soc2","relationship":"intersects_with"}],"statement":"Select and document a baseline of security and privacy controls — including general controls over technology — responsive to assessed risks, and tailor it to the organization's environment, complexity, and risk appetite, considering an appropriate mix of preventive and detective control types and segregation of duties. Centrally identify, manage, and deploy common controls where appropriate, and document and approve the rationale for all tailoring decisions.","title":"Select and tailor a risk-based control baseline","unified_id":"UC-GOV-16"},"id":"uc:UC-GOV-16","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-16","sourceIds":["nist-800-53","soc2"],"sourceUrl":null,"title":"UC-GOV-16 — Select and tailor a risk-based control baseline","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0f98dfff9e7c236405279a2b7c455b809852b2e7309ed031b969fb1b5294074e","properties":{"rationale":"Selecting and tailoring a risk-based control baseline with SoD and a preventive/detective mix directly builds adequate controls.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","sourceId":"uc:UC-GOV-16","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:100fe01610faae2684f5795798b84e7f9a0ca6283f57cf35610d13f5c34931c5","properties":{},"sourceDetailPath":"/data/v1/records/wf-g6-86d7ed66.json","sourceId":"wf:G6","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:127c3cb86d6ded7bdc55d0fc4200e4848b276cb0fcab40f9825b1c35445d4e8a","properties":{},"sourceDetailPath":"/data/v1/records/wf-r5-c423cac7.json","sourceId":"wf:R5","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:388888a287f62a73322d65fbe5d3794c806d311a9042d943c4b088e429ba1470","properties":{"rationale":"Baseline general controls over technology support reliable financial reporting.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","sourceId":"uc:UC-GOV-16","targetDetailPath":"/data/v1/records/risk-fin-icfr-material-weakness-cdd66323.json","targetId":"risk:fin-icfr-material-weakness","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47c225cbe2499d20808ce5df245f6eb8d6ab09ce5dc0f71a39ecf0937c5a9ad7","properties":{},"sourceDetailPath":"/data/v1/records/wf-c7-acbef2ee.json","sourceId":"wf:C7","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:53e3e3ac4894832648522f3d0e2a4e21facfb9cf281c222080c9f0066dfa7383","properties":{"control_id":"PL-11","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","sourceId":"uc:UC-GOV-16","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pl-11-d678e388.json","targetId":"ctrl:nist-800-53:PL-11","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:57dd2dd098789ed299c54a17da93ed111d2f50ee1dc5b5b60d2cda56e241495c","properties":{},"sourceDetailPath":"/data/v1/records/wf-d24-a9f3daf6.json","sourceId":"wf:D24","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:68ad0995eb5f65f34ac24c81e132ab18309ebfb79bb3eda4e28ac1f4b2e831fb","properties":{},"sourceDetailPath":"/data/v1/records/wf-a15-e859f6b8.json","sourceId":"wf:A15","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8dd535accf8acac48be78be5022ebf3653a4328f2935c9447d4ee66333c0bc93","properties":{},"sourceDetailPath":"/data/v1/records/wf-c8-5634a289.json","sourceId":"wf:C8","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9ff334da4534cb52f620cc027d52af80001c99a8241365f0fd0fef8dc0cd67a5","properties":{},"sourceDetailPath":"/data/v1/records/wf-g34-1b925ad7.json","sourceId":"wf:G34","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a89e0d8a637e27b7628d483bba78c5fc3cb5309bb0925e146ce9020c11a30558","properties":{"control_id":"PL-9","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","sourceId":"uc:UC-GOV-16","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pl-9-b31d458e.json","targetId":"ctrl:nist-800-53:PL-9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:baa62d7911b5a63df9a179a2a3f8cd4c2da2f87e34ead389fb8ab12a79907568","properties":{"control_id":"CC5.2","coverage":"partial","delta":"developing and operating the specific technology general controls (infrastructure, security management, acquisition/development/maintenance) satisfied by dedicated ITGC companion controls; this UC delivers their selection into the baseline","framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","sourceId":"uc:UC-GOV-16","targetDetailPath":"/data/v1/records/ctrl-soc2-cc5-2-2d184a95.json","targetId":"ctrl:soc2:CC5.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c28c59143c0fc5be05572085b66ae8e5a85ad1c903f6ab4173f05266021de497","properties":{"control_id":"PL-10","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","sourceId":"uc:UC-GOV-16","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pl-10-ee28a9a6.json","targetId":"ctrl:nist-800-53:PL-10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dbc5217ac41f33089641bd0371098fb628ac8761239870cba712af1bf675eebd","properties":{},"sourceDetailPath":"/data/v1/records/wf-d05-2302db1f.json","sourceId":"wf:D05","targetDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","targetId":"uc:UC-GOV-16","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ff53461ebd7baefda3430830c2703050a34ef52547441cdc32b97c0a0532e271","properties":{"control_id":"CC5.1","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-16-694834ac.json","sourceId":"uc:UC-GOV-16","targetDetailPath":"/data/v1/records/ctrl-soc2-cc5-1-b6b93caa.json","targetId":"ctrl:soc2:CC5.1","type":"maps_to"}],"schemaVersion":1}