Prioritizing IT Controls for Effective, Measurable Security
• SEI Report
Publisher
Software Engineering Institute
Abstract
This article summarizes results from the IT Controls Performance Study conducted by the IT Process Institute. The article describes what differentiates high performing organizations in IT and security from others and identifies six foundational controls that are deployed by these organizations.
Cite This SEI Report
Phelps, D., Kim, G., & Milne, K. (2013, July 2). Prioritizing IT Controls for Effective, Measurable Security. Retrieved September 17, 2026, from https://www.sei.cmu.edu/library/prioritizing-it-controls-for-effective-measurable-security/.
@techreport{phelps_2013,
author={Phelps, Daniel and Kim, Gene and Milne, Kurt},
title={Prioritizing IT Controls for Effective, Measurable Security},
month={Jul},
year={2013},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/prioritizing-it-controls-for-effective-measurable-security/},
note={Accessed: 2026-Sep-17}
}
Phelps, Daniel, Gene Kim, and Kurt Milne. "Prioritizing IT Controls for Effective, Measurable Security." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, July 2, 2013. https://www.sei.cmu.edu/library/prioritizing-it-controls-for-effective-measurable-security/.
D. Phelps, G. Kim, and K. Milne, "Prioritizing IT Controls for Effective, Measurable Security," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 2-Jul-2013 [Online]. Available: https://www.sei.cmu.edu/library/prioritizing-it-controls-for-effective-measurable-security/. [Accessed: 17-Sep-2026].
Phelps, Daniel, Gene Kim, and Kurt Milne. "Prioritizing IT Controls for Effective, Measurable Security." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 2 Jul. 2013. https://www.sei.cmu.edu/library/prioritizing-it-controls-for-effective-measurable-security/. Accessed 17 Sep. 2026.
Phelps, Daniel; Kim, Gene; & Milne, Kurt. Prioritizing IT Controls for Effective, Measurable Security. Software Engineering Institute. 2013. https://www.sei.cmu.edu/library/prioritizing-it-controls-for-effective-measurable-security/