• Describe one or two of the best security controls to implement to address a potential security risk. You need to include the following factors:
  • Discuss the compatibility. Assess whether the security control works with the existing infrastructure of the organization you selected, or if it requires new hardware and software to make it work.
  • Evaluate the effectiveness. Does the control work well in the business environment of the organization you selected? If the control is only partially effective or it doesn't provide much benefit, it may not be worth the cost to implement.
  • Explain how you have taken into account any regulatory compliance requirements impacted by the control and made sure you aren't breaking any laws.
    • For example, if federal law requires you to maintain an archive of all email messages that come into your network, a spam reduction security control might delete messages that the law requires to be archived.
  • Assess whether the security control violates any of the company policies.