Glossary · C
Control
A control is a measure, technical, procedural or physical, put in place to reduce a specific risk to an acceptable level.
Extended definition
In more detail.
Multi-factor authentication, a backup schedule, a vendor review procedure and a locked server room are all controls. Each exists to address a risk, should have an owner, and should produce evidence that it operates. Frameworks such as ISO/IEC 27001, NIST SP 800-171 and SOC 2 are organized as sets of controls or requirements. A control that nobody can show operating is, for assurance purposes, absent.
In our work
Where it appears.
Control validation tests whether controls operate as designed, under real conditions, rather than whether they are documented.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days