Customized Approach Objective

Applies to. The objective is printed in the standard beside each requirement that allows the Customized Approach. An entity using that approach must show, for each such requirement, that its control meets the objective: it documents the control in a controls matrix, performs a targeted risk analysis approved by senior management and repeats that analysis at least once every 12 months, following Appendix D and the Customized Approach risk analysis requirement in Requirement 12. The assessor then writes testing procedures for that control instead of using the defined approach procedures.

Limits. Requirements published without an objective cannot be met with the Customized Approach; for those the choice is the defined approach or, where a documented constraint exists, a compensating control.