Which two local conditions does NIST say may be used to tailor a control baseline? Choose two.

Answer: C. Specific threat information relevant to the organisation
B. The availability of compensating controls

SP 800-100 tailors a baseline on a risk assessment plus local conditions: organisation-specific requirements, threat information that applies here, cost-benefit work, whether compensating controls exist, and special circumstances.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.1 System Boundary Analysis