A cybersecurity control should be selected without considering the organization's assessed risks.

### Why this is right The statement is false because control selection should respond to risks and organizational requirements. Risk assessment gives a reason for choosing particular safeguards. ### The concept Controls consume resources and can affect operations. Selecting them without understanding the exposure may leave important risks untreated or add measures that do not fit the organization's needs. Reviewing controls helps determine whether they still work as intended. ### The other options - **True**: this would make control selection disconnected from risk priorities. ### Terms - **Control**: A safeguard intended to reduce risk. - **Risk assessment**: A process for identifying and evaluating risks. ### Remember Choose safeguards because of the risks they address.