When should information security controls be considered?

The selection of information security controls is a fundamental part of the risk treatment phase. According to the information security risk management process defined in standards like ISO/IEC 27001, risk treatment logically follows risk assessment. An organization must first complete the risk assessment—which involves identifying, analyzing, and evaluating risks—to understand its specific threat landscape and vulnerabilities. Only with this comprehensive understanding can appropriate and cost-effective controls be selected to mitigate the identified risks to an acceptable level. Choosing controls before or during the assessment would be premature and not based on a formal evaluation of risk.

B. The scoping meeting defines the boundaries of the Information Security Management System (ISMS); specific risks have not yet been assessed, making control selection premature.
C. The kick-off meeting is for project initiation; the detailed risk information required for selecting appropriate controls is not yet available.
D. During the risk assessment, the focus is on identifying, analyzing, and evaluating risks, which provides the necessary input for the subsequent control selection phase.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Clause 6.1.2, "Information security risk assessment," and Clause 6.1.3, "Information security risk treatment." The structure of the standard explicitly places the risk treatment process (which includes selecting controls) after the risk assessment process. The output of 6.1.2 is the input for 6.1.3.

2. University of Cambridge, University Information Services. "Information Security Risk Management Process."

Reference: The process diagram and description show a clear sequence where "Risk Assessment" (Step 2) is completed before "Risk Treatment" (Step 3). The document states, "The purpose of risk treatment is to select and implement appropriate controls to reduce risks identified in the risk assessment." This confirms controls are considered after the assessment.

3. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004

Reference: Page 100, Section 3. This peer-reviewed article discusses the evolution of information security management based on ISO 27001. It describes the risk management cycle where risk analysis and evaluation (assessment) precede the implementation of countermeasures (controls), reinforcing the correct sequence of activities.