When identifying and analyzing risk mitigation security controls, what is in place needs to be identified. An in-place control is installed in an operational system. Associated documentation should identify its purpose.

Some of these in-place controls may need to be replaced, which depends on whether they meet current goals. For example, an antivirus software may be installed on systems in the network. However, the systems may have been infected by malware in the past year, which prompts the decision to replace it with something considered more reliable.

Based on such information, any controls in place should be evaluated for their effectiveness. If a control is determined to be not effective, it can be replaced with an alternative control.

Controls, also called countermeasures, will reduce or neutralize threats or vulnerabilities. Controls have three primary objectives:

• Prevent
• Recover
• Detect

Some controls focus on only one objective, and other controls focus on more than one. However, if a control can’t meet one of these objectives adequately, it should be replaced.