My background is working on production systems and maintaining existing ATOs. I am now working on standing up an environment where our ITCSC has been submitted and I am awaiting approval of a Mod-Mod-Low baseline.

How do I go about implementing the controls from here? I am a bit overwhelmed on where to begin and a logical way to plan out implementation.