Security fundamentals

What is a security control?

A security control is a safeguard or countermeasure, technical, administrative, or physical, that reduces information security risk by preventing, detecting, or correcting a threat.

Definition

A security control is a specific safeguard or countermeasure put in place to reduce information security risk. Controls are commonly categorized by function (preventive, detective, corrective) and by type (technical, administrative, and physical).

Background

Every compliance framework is, at heart, a set of expected security controls. SOC 2 has its Trust Services Criteria, ISO 27001 has its Annex A controls, and frameworks like NIST and CIS publish their own control sets. Because the same underlying safeguard (say, multi-factor authentication) satisfies requirements in many frameworks, a control can be mapped, or crosswalked, to several standards at once.

Why it matters

Controls are the unit of work in a compliance program: you implement them, prove they operate with evidence, and map them to the frameworks you need. Thinking in controls rather than in separate frameworks is what lets you collect evidence once and satisfy many standards.

Step by step

1. Identify the risk the control is meant to reduce.
2. Choose the control type that fits (preventive, detective, or corrective).
3. Assign an owner and implement it.
4. Collect evidence that the control operates, not just that it exists.
5. Map the control to the framework requirements it satisfies.
6. Review it on a cadence and after significant change.

Examples

• Preventive technical control: enforcing multi-factor authentication on all administrative access.
• Detective technical control: centralized logging and alerting on suspicious activity.
• Administrative control: an access-review process that removes access when someone changes roles.

Common mistakes

• Documenting a control on paper without evidence that it actually operates.
• Duplicating control work per framework instead of mapping one control to many.
• Owning controls nowhere, so nobody maintains them between audits.

FAQ