Tailoring and Scoping

Tailoring process refers to modifying or customizing a list of security controls to align with a mission of an organization. Scoping process refers to reviewing a list of baseline security controls and selecting only those controls that apply to the IT systems that organization are trying to protect from cyberattacks. Furthermore, scoping is a part of the tailoring process and refers to reviewing a list of security controls and selecting the security controls that align with organizational security strategies. In other words, tailoring includes scoping processes. The difference between tailoring and scoping is that scoping focuses on the security of the system and tailoring ensures that the selected controls align with the mission of the organization.