Insights · Field note · Security assurance and compliance
Control validation versus control existence
A control that is installed, configured and documented can still fail to do anything. Validation is the test that it does.
Control existence is the state in which a control is present: the tool is deployed, the rule is written, the policy is approved. Control validation is the test that the control produces its intended effect under realistic conditions: the alert fires, the access attempt is blocked, the backup restores, the segment holds. Audits often check existence; attackers test validation. The difference between the two is where most serious findings live, and it is why a clean audit and a successful breach can describe the same environment in the same year.
In detail
What the evidence shows.
Why existence is not enough
Endpoint protection deployed to most devices, with the exceptions nobody tracked. A firewall rule that permits what it was meant to deny because of an ordering error. An alert rule that fires into a queue nobody reads. A segmentation design that was never enforced on the switch. Each exists on paper and does nothing in practice. Existence is necessary; it is not the control.
What validation does
It exercises the control and observes the result. A simulated attempt against the rule. A test file through the filter. A restore from the backup. An access request from a non-compliant device. The method is recorded, the result is recorded, and the evidence shows the control operated on a date. NIST SP 800-115 describes testing and assessment methods of this kind.
How often
On a schedule, and after any change that could affect the control: a migration, a new tool, a reorganization, a vendor change. Controls drift. Validation on a cycle catches the drift before an attacker or an auditor does.
Where it fits in assurance
Posture reviews establish what exists. Control validation establishes what works. Evidence preparation records both for the people who must rely on them. See control validation, and penetration test versus vulnerability management review for the related distinction between a test and a process.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days