What is a security control taxonomy, and why is it important for architecture governance?

• A. A taxonomy classifies controls by objectives (preventive, detective, corrective), domain (physical, technical, administrative), and lifecycle, aiding selection, mapping, and assurance.
• B. It defines encryption keys and certificates for all systems.
• C. It replaces risk management frameworks.
• D. It lists all possible security controls without categorization.

Answer: (C)

A security control taxonomy is a structured way to classify security controls by objective type (preventive, detective, corrective), by domain (physical, technical, administrative), and by lifecycle stage. This organization gives a consistent framework for selecting controls, mapping them to architectural components and risk treatment plans, and gathering evidence for assurance and audits.

For architecture governance, this taxonomy provides a common language and a clear view of how controls relate to business risks and regulatory requirements. It helps ensure that the control set covers all necessary areas, supports baseline development and regional or project-specific tailoring, and makes it easier to trace how a control was chosen, implemented, and maintained across the enterprise. It also enables gap analyses, rollouts, and ongoing assurance by giving governance teams a repeatable way to compare architectures, justify decisions, and demonstrate alignment with risk management processes.

The other options miss the broader purpose: focusing only on encryption materials is too narrow; listing every possible control without categorization loses the ability to reason about coverage and mapping; and claiming that a taxonomy replaces risk management frameworks misunderstands its role—it complements and supports risk management rather than replacing it.