Common security controls are assessed, implemented, and monitored at the organizational level or functional level, not the individual system level. Assessing, implementing, and monitoring controls for each individual system does not realize economies of scale benefits. Organizations can more efficiently leverage controls that benefit multiple systems by designating them as common controls and handling them at higher organizational or functional levels.

1. From an economies of scale viewpoint, the assessment, implementation, and monitoring
activities of common security controls are not conducted at which of the following levels?
a) Organizational level
b) Individual system level
c) Multiple systems level
d) Functional level
Solution
b. Common security controls do not benefit at the individual system level because they benefit
many systems and the principle of economies of scale is applicable here. Organizations can
leverage controls used among multiple systems by designating them as common controls where
assessment, implementation, and monitoring activities are conducted at an organizational level or
by functional level or areas of specific expertise