Editing Information security (section)

=== Security controls ===
{{Main|security controls}}
Selecting and implementing proper security controls will initially help an organization bring down risk to acceptable levels.<ref>{{Cite journal|last=Parker|first=Donn B.|date=January 1994|title=A Guide to Selecting and Implementing Security Controls |url=http://dx.doi.org/10.1080/10658989409342459|journal=Information Systems Security|volume=3|issue=2|pages=75–86 |doi=10.1080/10658989409342459|issn=1065-898X}}</ref> Control selection should follow and should be based on the risk assessment.<ref>{{Cite journal|last1=Zoccali|first1=Carmine|last2=Mallamaci|first2=Francesca|last3=Tripepi|first3=Giovanni|date=2007-09-25 |title=Guest Editor: Rajiv Agarwal: Cardiovascular Risk Profile Assessment and Medication Control Should Come First |url=http://dx.doi.org/10.1111/j.1525-139x.2007.00317.x|journal=Seminars in Dialysis|volume=20|issue=5|pages=405–408 |doi=10.1111/j.1525-139x.2007.00317.x|pmid=17897245|s2cid=33256127|issn=0894-0959}}</ref> Controls can vary in nature, but fundamentally they are ways of protecting the confidentiality, integrity or availability of information. [[ISO/IEC 27001]] has defined controls in different areas.<ref>{{Cite book|url=http://dx.doi.org/10.3403/9780580829109|title=Guide to the Implementation and Auditing of ISMS Controls based on ISO/IEC 27001|date=2013-11-01|publisher=BSI British Standards|isbn=978-0-580-82910-9 |location=London|doi=10.3403/9780580829109}}</ref> Organizations can implement additional controls according to requirement of the organization.<ref name="JohnsonSecurity15">{{cite book |url=https://books.google.com/books?id=X7SYBAAAQBAJ&pg=PA9 |title=Security Controls Evaluation, Testing, and Assessment Handbook |author=Johnson, L. |publisher=Syngress |pages=678 |year=2015 |isbn=9780128025642}}</ref> [[ISO/IEC 27002]] offers a guideline for organizational information security standards.<ref>{{Citation|title=Information technology. Security techniques. Mapping the revised editions of ISO/IEC 27001 and ISO/IEC 27002 |url=http://dx.doi.org/10.3403/30310928|publisher=BSI British Standards|doi=10.3403/30310928|access-date=2021-05-29}}</ref>