Propose a risk-based control plan for the e-z-buy application, using examples from the lesson and explaining how the plan should be maintained.

### Why this is right The scenario combines sensitive data with an availability objective, so a suitable plan begins with assets and risk rather than selecting tools at random. Technical controls can be combined with administrative practices and continuous review. ### The concept A control plan should connect each safeguard to a risk it is intended to reduce. Encryption may help protect information from unauthorized reading; authentication controls can help protect accounts; firewalls can support network protection; monitoring can help detect changes or events that need attention. Policies and training address employee practices. The organization should document the reasoning and revisit the plan as threats, systems, or business needs change. ### What a good answer covers - Identify sensitive information and supporting systems as assets. - Consider confidentiality, integrity, and availability risks. - Choose controls that match identified risks rather than listing tools without justification. - Include policies, training, documentation, monitoring, and updates. ### Terms - **Integrity**: the condition of information remaining accurate and unaltered except by authorized activity. - **Multifactor authentication**: verification that requires more than one kind of evidence from a user. ### Remember A strong control plan explains what each safeguard protects and how its effectiveness will be reviewed.