What are the three classifications for security controls for information systems? Response:

System-specific controls are security controls that are unique to a particular information system and are implemented by that system, often to address specific risks or requirements not covered by common controls. These controls are distinct from common controls, which are inherited by multiple systems, and hybrid controls, which combine both.

"System-Security Controls" is not a standard classification term for security controls according to NIST frameworks.

"System-Common Controls" is redundant as "common controls" is the correct classification term itself, not prefixed by "system-".

"System-Custom Controls" is not a standard classification term for security controls; controls might be customized but that is not a classification type.