In RAM, one valid method to identify controls is from the control library.

In RAM, one valid method to identify controls is from the control library.

• A. Controls are identified from library and ad-hoc
• B. Controls identified from indicator results
• C. Controls identified from library
• D. Controls identified from related issues

Answer: (C)

Using a control library to identify controls relies on a centralized set of predefined, standardized controls that are designed to address common risk scenarios. In RAM, this library serves as the primary source for selecting controls because each control in it comes with a defined objective, testing requirements, owners, and evidence expectations. This helps ensure consistency across risks and assets, speeds up the setup by providing ready-to-use options, and supports auditability and framework alignment. Starting from the library ensures you’re applying vetted, broadly applicable controls rather than crafting ad-hoc measures. It also makes it easier to map controls to risk statements, maintain coverage across control families, and update controls as standards evolve. Choosing controls based on indicator results or related issues can reflect past outcomes or problems but may not offer a comprehensive, uniform set of preventive measures, which can leave gaps or lead to inconsistent implementations.

Using a control library to identify controls relies on a centralized set of predefined, standardized controls that are designed to address common risk scenarios. In RAM, this library serves as the primary source for selecting controls because each control in it comes with a defined objective, testing requirements, owners, and evidence expectations. This helps ensure consistency across risks and assets, speeds up the setup by providing ready-to-use options, and supports auditability and framework alignment.

Starting from the library ensures you’re applying vetted, broadly applicable controls rather than crafting ad-hoc measures. It also makes it easier to map controls to risk statements, maintain coverage across control families, and update controls as standards evolve. Choosing controls based on indicator results or related issues can reflect past outcomes or problems but may not offer a comprehensive, uniform set of preventive measures, which can leave gaps or lead to inconsistent implementations.