Abstract: A computer system and method is disclosed for automatically and dynamically mapping risk management controls to risk management profiles based upon criteria associated with each control and values associated with each risk management profile. A database is populated with a plurality of risk management controls which may correspond to the commandments of a security requirement. The database is also populated with a plurality of risk management profiles and associated attribute values which represent information technology subjects within an organization. A computer process maps each individual risk management control to the appropriate profiles so that the organization may properly execute the control on the associated subject. Alternatively, a set of risk management profiles may be automatically determined based upon the risk management profiles and a plurality of commandments associated with a security reference.