The organization
selects and develops
control activities that
contribute to the
mitigation of risks to
the achievement of
objectives to
acceptable levels.
The organization
selects and develops
general control
activities over
technology
to support the
achievement of
objectives.
The organization
deploys control
activities through
policies that establish
what is expected
and procedures
that put policies
into action.