A countermeasure or safeguard that is implemented in an informational system in part as a common control and in part as a system-specific control Response:

A system-specific control is entirely implemented by and unique to a single information system, without any shared components.

A logical control refers to software or data-oriented controls (e.g., passwords, encryption) and is a functional classification, not a provisioning classification.

A hybrid control is precisely defined as a control where some aspects are provided as a common control (e.g., an enterprise-wide policy or service) and other aspects are implemented specifically for an individual information system. This combination allows for a balance of shared services and system-unique requirements.

A common control is entirely inherited and provided by an organizational system or infrastructure, rather than being partially implemented by the individual system.