Which statement best describes Common Controls?

• A. They are inheritable
• B. They are system-specific
• C. They are Hybrid Controls
• D. They are not used

Answer: (A)

Common controls are security measures that an organization implements at a high level (often once for the entire enterprise or a large segment of it) and that can be inherited by multiple information systems within the authorization boundary. Because they’re managed centrally, a single implementation can satisfy the security requirements for many systems, reducing duplication and the ongoing assessment burden. This is why they’re described as inheritable. They aren’t tied to a single system (not system-specific), they aren’t a separate “hybrid” category, and they’re clearly used across the organization.