What is the best way to start setting the information security controls?

The most effective and standard way to begin setting information security controls is by establishing a security baseline. A baseline defines a consistent, mandatory minimum level of security that applies to all systems and components across the organization. This approach ensures a uniform security posture and simplifies management and auditing. Once the baseline is implemented, a risk analysis can be performed to identify specific threats and vulnerabilities that may require additional controls beyond the baseline standard. This structured methodology is a fundamental principle in established information security management frameworks.

A. A risk analysis is performed to identify needs for controls beyond the baseline, making it a subsequent, not an initial, step.
B. Default factory standards are often insecure and are considered a primary vulnerability, not a secure foundation for an organization's security.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5). Section 2.3, "Control Selection Process," p. 16. This document explicitly describes the process of selecting an initial baseline of controls as a foundational step.

(Available at: https://doi.org/10.6028/NIST.SP.800-53r5)

2. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. This academic paper discusses the evolution of security practices, implicitly supporting the foundational nature of baselines (standard information security controls) before addressing more complex cyber threats.

(DOI: https://doi.org/10.1016/j.cose.2013.04.004)

3. Tipton, H. F., & Krause, M. (Eds.). (2007). Information Security Management Handbook (6th ed., Vol. 1). Auerbach Publications. Chapter 2, "The Information Security Program," discusses establishing a baseline of minimum-security requirements as a fundamental element of a comprehensive security program.

(ISBN: 978-0849374951)