Identify and Document Controls
Identify existing controls and list them in the cell for each asset and threat
For each asset and the specific threat
- Describe each control that
- Prevents,
- Detects and/or
- Corrects that threat
- Place each control and its role in a numeric list (without any ranking)
- Place the number in the cell (in the control spreadsheet)
- Each cell may have one or more controls