[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-243610-105":53,"doc-detail-243610-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","crr-supplemental-resource-guide-volume-2-controls-management-version-1-11","CRR Supplemental Resource Guide - Volume 2 - Controls Management - Version 1 -1.1","","CRR Supplemental Resource Guide provides a structured framework for controls management, covering an end-to-end lifecycle from planning through definition, analysis, deployment, and assessment. It explains how to define controls, establish governance and responsibility, and translate security requirements into traceability matrices. The guide also details preparation steps, including obtaining support, setting a controls development strategy, running controls identification and analysis processes, and producing clear outputs for subsequent phases. Distribution approval and warranty disclaimers define usage terms.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":46,"@type":70,"position":76},"https://docshare.wps.com/template/paper-templates/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/crr-supplemental-resource-guide-volume-2-controls-management-version-1-11/243610/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/crr-supplemental-resource-guide-volume-2-controls-management-version-1-11/243610.png","ImageObject",442,249,{"name":88,"@type":89},"Stanley","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-08","2026-09-12",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",9,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What does the Controls Management section cover?","Question",{"text":109,"@type":110},"It covers the controls lifecycle including planning, defining controls, analyzing and deploying controls, assessing controls, and summarizing the steps across phases.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How are controls planned before implementation?",{"text":114,"@type":110},"Planning begins by obtaining support, establishing a controls development strategy, setting up controls identification and analysis processes, and defining a controls assessment process.",{"name":116,"@type":107,"acceptedAnswer":117},"How should controls be documented for traceability?",{"text":118,"@type":110},"Controls should be documented in a security requirements traceability matrix to link defined controls with security requirements.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},243610,1790269028,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":45,"category_name":46,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":25},2336477405376,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","CRR Supplemental Resource Guide  \nVolume 2  \nControls Management  \nVersion 1.1  \nCopyright 2016 Carnegie Mellon University  \nThis material is based upon work funded and supported by Department of Homeland Security under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center sponsored by the United States Department of Defense.  \nAny opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of Department of Homeland Security or the United States Department of Defense.  \nNO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.  \n[Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution.  \nCERT® and OCTAVE® are registered marks of Carnegie Mellon University.  \nDM-0003276  \nTable of Contents  \nI. Introduction ............................................................................................................................................................... 1  \nSeries Welcome ......................................................................................................................................................... 1  \nAudience ....................................................................................................................................................................3  \nII. Controls Management .............................................................................................................................................4  \nOverview ....................................................................................................................................................................4  \nPlan for Controls Management ..................................................................................................................................5  \nDefine Controls ..........................................................................................................................................................5  \nAnalyze and Deploy Controls.....................................................................................................................................5  \nAssess Controls .........................................................................................................................................................6  \nSummary of Steps .....................................................................................................................................................6  \nIII. Plan for Controls Management ..............................................................................................................................8  \nBefore You Begin .......................................................................................................................................................8  \nStep 1. Obtain support for controls management planning........................................................................................9  \nStep 2. Establish a controls development strategy....................................................................................................9  \nStep 3. Establish a controls identification process................................................................................................... 14  \nStep 4. E","cbCaiqKRn33BQ7pl","https://ap.wps.com/l/cbCaiqKRn33BQ7pl","pdf",969101,44,"English","# Introduction\n## Series Welcome\n## Audience\n# Controls Management\n## Overview\n## Plan for Controls Management\n## Define Controls\n## Analyze and Deploy Controls\n## Assess Controls\n## Summary of Steps\n# Plan for Controls Management\n## Before You Begin\n## Step 1. Obtain support for controls management planning\n## Step 2. Establish a controls development strategy\n## Step 3. Establish a controls identification process\n## Step 4. Establish a controls analysis process\n## Step 5. Establish a controls assessment process\n# Define Controls\n## Before You Begin\n## Step 1. Assign responsibility and define enterprise-level controls\n## Step 2. Assign responsibility and define service-and asset-level controls\n## Step 3. Document the controls in a security requirements traceability matrix\n# Analyze and Deploy Controls\n## Before You Begin\n## Step 1. Analyze existing controls against objectives\n## Step 2. Identify gaps","[{\"question\":\"What does the Controls Management section cover?\",\"answer\":\"It covers the controls lifecycle including planning, defining controls, analyzing and deploying controls, assessing controls, and summarizing the steps across phases.\"},{\"question\":\"How are controls planned before implementation?\",\"answer\":\"Planning begins by obtaining support, establishing a controls development strategy, setting up controls identification and analysis processes, and defining a controls assessment process.\"},{\"question\":\"How should controls be documented for traceability?\",\"answer\":\"Controls should be documented in a security requirements traceability matrix to link defined controls with security requirements.\"}]","CRR Supplemental Resource Guide - Volume 2 - Controls Management - Version 1 -1.1 | PDF",1789206273]