NIST

Use the customer’s selected control baseline to structure requirements, implementation evidence and verification. Review access control, audit, configuration and incident response within the deployment boundary.