Summary
At the beginning of this chapter, we learned about the five control categories (preventative, detective, corrective, deterrent, and compensating) and their relationship with incidents. We then learned about how a risk manager should design and select the controls as per the requirements of the business. Next, we learned about the different methods of control implementation (parallel, phased, and abrupt) and the importance of post-implementation review. Finally, we reviewed the best practices for control testing and evaluation.
In the next chapter, we will learn about log aggregation, risk and control monitoring, and reporting.
