Control Inheritance

Control Inheritance is the practice of deriving security controls from higher-level systems or parent organizations rather than implementing them independently.

This occurs when a system or component automatically receives and benefits from security measures that have been established at a broader organizational, infrastructural, or platform level.

Common examples include cloud services that inherit physical security controls from the data center where they operate, or applications that inherit network security controls from the underlying corporate network infrastructure. In these cases, the inheriting system doesn't need to duplicate these protections—it leverages existing ones.

Control inheritance is particularly valuable in complex IT environments because it reduces redundancy, lowers costs, and ensures consistency across systems. However, organizations must carefully document which controls are inherited and from where, as this affects compliance reporting and risk assessments. The inheriting system remains responsible for ensuring that inherited controls are appropriate, properly configured, and continuously effective for its specific security requirements and threat model.