The answer is Tailoring the baseline to their needs.
After an organization selects applicable security control baseline but finds not all of the controls apply, it initiates a tailoring process to modify the controls appropriately and more closely with specific conditions related to organizational missions, information systems or environments of operation. It is an integral part of the security control selection and specification and involves risk management processes like assessing, responding to, and framing.
