Which type of controls can be inherited by one or more organizational information systems?

Which type of controls can be inherited by one or more organizational information systems?

• A. Common controls
• B. Security controls
• C. Administrative controls
• D. Preventive controls

Answer: (A)

Common controls are designed to be shared across multiple organizational information systems and can be inherited by them. These controls provide a foundational layer of security that can help ensure consistent protections across different systems without requiring duplication of effort. For example, a common control could be an organization's security policy or physical security measures that all systems within the organization must adhere to. In contrast, security controls is a broader term that includes various types of controls—preventive, detective, and corrective—that can sometimes be specific to individual systems rather than applicable across the organization. Administrative controls refer specifically to policies, procedures, and regulations guiding the security policies, while preventive controls aim to prevent security incidents from occurring in the first place. These latter types of controls may not inherently support inheritance by multiple systems in the way that common controls do, as they are often tailored to the needs of individual systems. Thus, common controls are the most appropriate answer since they are explicitly structured for use across multiple systems in an organization.

Common controls are designed to be shared across multiple organizational information systems and can be inherited by them. These controls provide a foundational layer of security that can help ensure consistent protections across different systems without requiring duplication of effort. For example, a common control could be an organization's security policy or physical security measures that all systems within the organization must adhere to.

In contrast, security controls is a broader term that includes various types of controls—preventive, detective, and corrective—that can sometimes be specific to individual systems rather than applicable across the organization. Administrative controls refer specifically to policies, procedures, and regulations guiding the security policies, while preventive controls aim to prevent security incidents from occurring in the first place. These latter types of controls may not inherently support inheritance by multiple systems in the way that common controls do, as they are often tailored to the needs of individual systems. Thus, common controls are the most appropriate answer since they are explicitly structured for use across multiple systems in an organization.