ISC2 Governance, Risk and Compliance (CGRC) Practice Question

In NIST guidance, a common control is a security or privacy control whose protection capability is inheritable by multiple information systems. An organization-wide SOC that centrally performs incident monitoring and response meets this definition, because each system relies on and benefits from the same control implementation without duplicating it locally. A management control focuses on governance activities such as policies and planning, not hands-on monitoring. An operational control is implemented primarily by people for a single system or enclave, while a technical control is enforced by hardware or software resident within an individual system or application. Thus, the SOC's enterprise service is most accurately categorized as a common control that other systems inherit.