An organization is implementing a preselected baseline of security controls, but finds not all of the controls apply. what should they do? a. implement all of the controls anyway. b. identify another baseline. c. re-create a baseline. d. tailor the baseline to their needs.

The answer is Tailoring the baseline to their needs.

After an organization selects applicable security control baseline but finds not all of the controls apply, it initiates a tailoring process to modify the controls appropriately and more closely with specific conditions related to organizational missions, information systems or environments of operation. It is an integral part of the security control selection and specification and involves risk management processes like assessing, responding to, and framing.