Controls are the countermeasures that reduce risk to acceptable levels. Understanding how to classify, select, and evaluate controls is the core technical skill of every GRC professional.
A security control is any safeguard or countermeasure — policy, procedure, technology, or physical measure — that reduces the likelihood or impact of a security risk. Controls do not eliminate risks; they modify them.
| Category | Definition | Examples |
|---|---|---|
| Administrative | Policies, procedures, and training — people and process controls | Acceptable Use Policy, security awareness training, background checks |
| Technical | Technology-based controls implemented in hardware, software, or firmware | Firewalls, MFA, encryption, intrusion detection systems, access controls |
| Physical | Physical barriers and environmental controls | Badge readers, security guards, cable locks, biometric entry, camera systems |
| Function | Timing | Examples |
|---|---|---|
| Preventive | Before the incident — stops it from happening | Firewall rules, encryption, locked door, security training |
| Detective | During/after — identifies that something happened | IDS/IPS, security cameras, audit logs, SIEM alerts |
| Corrective | After — restores normal state | Backup restoration, patch deployment, incident remediation |
| Deterrent | Before — discourages attackers | Warning banners, visible cameras, security guard presence |
| Compensating | Any time — replaces a primary control when it cannot be implemented | Additional logging where MFA cannot be deployed on legacy systems |
NIST 800-53 Rev. 5 is the most comprehensive security control catalog in existence, with over 1,000 controls organized into 20 control families:
Account management, access enforcement, least privilege, separation of duties, remote access controls. Foundation for every identity and access management program.
Audit event logging, log review, log protection, retention, and audit reduction tools. Non-repudiation and forensic readiness depend on this family.
Baseline configuration, configuration change control, security impact analysis, least functionality. Prevents configuration drift — a top source of vulnerabilities.
Incident response planning, training, testing, handling, monitoring, and reporting. Defines how the organization detects, contains, and recovers from incidents.
Risk assessment procedures, vulnerability monitoring and scanning, threat hunting. Connects the risk management process to specific control implementation.
Acquisition process, developer security testing, supply chain risk management, external system services. Covers DevSecOps and TPRM from a control perspective.
NIST 800-53 Rev. 5 added privacy controls (PT family) and supply chain risk management (SR family) — reflecting the modern threat landscape.
ISO 27002:2022 reorganized its controls into four themes with 93 controls:
Screening, terms of employment, security awareness, disciplinary process, remote working. People are both the strongest and weakest security element.
Policies, roles, threat intelligence, asset inventory, classification, supplier relationships, incident management. The governance layer of the control set.
Physical security perimeters, entry controls, securing offices, protecting against physical threats, clear desk/screen, equipment security.
User endpoints, PAM, malware protection, backup, logging, network filtering, WAF, DLP, SIEM, vulnerability management, code review.
ISO 27002:2022 introduced 11 new controls reflecting the modern threat landscape: threat intelligence, information security for cloud, ICT readiness, data masking, data leakage prevention, monitoring activities, web filtering, secure coding, and configuration management — all areas where traditional frameworks were weak.
Defense in Depth is a military strategy adapted to information security. It assumes that no single control will be 100% effective and layers multiple controls so attackers must defeat all of them to succeed. Key principles:
Controls operate at multiple layers: perimeter (firewall), network (segmentation), host (EDR, hardening), application (WAF, code review), data (encryption, DLP), identity (MFA, PAM). A breach at one layer is stopped by the next.
Use controls from different vendors and technologies. An attacker who knows how to bypass one vendor's firewall shouldn't automatically bypass all your controls.
Modern defense in depth assumes the perimeter will eventually be compromised. Design controls to contain, detect, and recover from breaches — not just prevent entry.
Where primary controls cannot be implemented (legacy systems, cost constraints), implement compensating controls that achieve equivalent risk reduction through alternative means.
The MITRE ATT&CK framework documents real-world adversary tactics, techniques, and procedures (TTPs) observed in the wild. GRC professionals use it to:
For each attack technique in the matrix, identify which defensive controls reduce its likelihood or limit its impact. Reveals coverage gaps in your control environment.
Techniques frequently used by threat actors relevant to your industry should drive control prioritization — not generic best-practice checklists.
Map your SIEM detection rules to ATT&CK techniques. Identify which techniques have no detection coverage — your blind spots.
Combine ATT&CK with threat intelligence about adversaries targeting your sector to build a truly threat-informed security control program.
A control objective states the desired outcome a control must achieve. It bridges the gap between a risk statement and a specific control implementation:
| Risk | Control Objective | Example Control |
|---|---|---|
| Unauthorized access to customer database | Only authorized personnel can access the database with least privilege | RBAC with quarterly access reviews; MFA on DB connections |
| Ransomware encrypting critical files | Critical data can be restored within RTO from immutable backups | Offline immutable backups tested monthly; 3-2-1 backup strategy |
| Phishing leading to account compromise | Phishing attempts are blocked or detected before credentials are submitted | Email filtering + DMARC + security awareness training + MFA |
| Unpatched vulnerability exploitation | Critical patches applied within 15 days of release | Vulnerability scanner + patch management tool + SLA tracking |
Classify each security control by its type (Administrative, Technical, Physical) AND its function (Preventive, Detective, Corrective, Deterrent, Compensating). This is a foundational skill for control frameworks, audit work, and GRC programme design.