Text decision tree

Adapted from Appendix F of Decision Trees: Frameworks for Technology Choices. Sources reviewed 2026-11-11.

START: A product category does not replace an accountable control owner.
Q1. Identity or access gap exists?
  Yes -> Define the IAM control boundary. Authentication and authorization. [Q2]
  No -> Otherwise examine the data protection boundary. [Q2]
Q2. Sensitive-data handling gap exists?
  Yes -> Define data protection controls. Classification and loss prevention. [Q3]
  No -> Otherwise examine threat visibility. [Q3]
Q3. Threat visibility or correlation gap?
  Yes -> Evaluate SIEM and XDR coverage. Connect relevant security telemetry. [Q4]
  No -> Otherwise verify the existing detection coverage. [Q4]
Q4. Response owners and controls defined?
  Yes -> Exercise the complete response path. Test approvals, recovery and evidence. [END]
  No -> Otherwise assign ownership and define the response boundary before automating. [STOP]
END: Test the complete control chain and record owners, exceptions and evidence.

AI-generated chapter illustration

Conceptual illustration for Choose security control boundaries

The illustration shows ownership across cloud and on-premises control boundaries rather than the four yes/no gates. Its identity/data boundary labels and generic all-in-one box do not define product coverage. Use the text tree and deterministic graph for exact control routing and approvals.

The illustration was generated in BookWriter. Its visual arrangement is interpretive; use the explicit nodes and routes in the graph and text tree for the decision.

Primary references