Tailoring

Tailoring picks up where scoping leaves off. Once scoping has decided which baseline controls apply at all, tailoring customises how those controls are implemented for the organisation. That includes setting control parameters (a password minimum, a review cadence), applying compensating controls where the baseline control is impractical, and documenting the assumptions behind each choice. The control still applies; tailoring shapes it to fit.

Held next to scoping, the division is clean: scoping is the binary whether, tailoring is the how. Getting them backwards is the mistake the scoping versus tailoring insight is built to prevent. Tailoring is also where risk-based judgement enters, because adjusting a control’s strength is a decision about acceptable risk, made and recorded rather than left to default.

Exam relevance: choose tailoring when a control clearly applies but the scenario adjusts, strengthens, or substitutes its implementation. Keywords: “adjust the parameter”, “compensating control”, “customise to our environment”. If instead the control is being removed as inapplicable, the answer is scoping, not tailoring.