Choosing which CIs to record will depend on the level of control an organization wishes to exert.