Security control
A specific safeguard put in place to reduce risk, whether technical, administrative, or physical.
Controls fall into families: preventive ones stop something happening, detective ones notice when it does, and corrective ones limit the damage afterwards. A sound program has all three.
For audit purposes a control is only as good as the evidence it operated. A policy nobody follows and a tool nobody checks both fail testing regardless of intent.
Where this comes up
Security control sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Compensating control An alternative safeguard used when a required control cannot be implemented, providing comparable protection. Audit evidence The records that demonstrate a control was actually operating, not merely defined. Audit log A record of who did what, when, in a system, retained so it can be reviewed later. Gap assessment A comparison of current practice against a target framework, producing a prioritized list of what is missing.