A security or privacy control that is implemented for an information system in part as a common control and in part as a system-specific control. See hybrid control.
Source(s):
NIST SP 800-53 Rev. 5