security control baselines

starting points that company’s should use, and should be proportionate to the level of security required

You must fine-tune security controls