Glossary · C
Control validation
Control validation is the testing of a security control under realistic conditions to confirm it operates as designed and produces the intended effect.
Extended definition
In more detail.
Validation goes beyond confirming a control is configured: it exercises the control and observes the result. Does the alert fire when the condition occurs? Does the access rule block the attempt? Does the backup restore? Validation produces evidence of operation, which is what auditors sample and what distinguishes a program that works from one that is documented. It is repeated on a schedule and after change.
In our work
Where it appears.
See control validation under Cyber Assurance; recovery controls are validated under recovery testing.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days