2) Security Controls Selection: The GC as a cloud
provider already publishes their security controls database.
Swinburne and Auckland can register their own security
controls using the security controls manager service. Based
on the security categorization step, the framework generates
the security controls’ templates baseline. This baseline
identifies the security controls’ templates that are: satisfied
(matches one of the registered security controls), missing
(does not match registered security controls), and duplicate
(more than one matched control), shown in Figure 5.