What is a security control?
A security control is a safeguard or action that prevents an event, detects it, limits its impact or supports recovery. It should address a specific risk scenario, such as server-room entry, account takeover, ransomware, power failure or an unauthorised configuration change.
Preventive control
Reduces event likelihood through MFA, least privilege, segmentation or hardening.
Detective control
Logs, monitoring, EDR, IDS/IPS and alerts identify changes requiring assessment and escalation.
Corrective control
Isolation, recovery, access resets and remediation plans limit the impact of a confirmed event.
NIST Cybersecurity Framework 2.0
The official NIST framework helps organisations structure cyber risk governance, controls and measurable outcomes.
Physical and environmental security controls
Access to a building, archive, network cabinet and server room must reflect asset criticality. A camera alone is insufficient if recordings are not reviewed, former employees retain cards or nobody responds to temperature, humidity, smoke, water or power-loss alarms.
- Access zones, named badges, cards or biometrics, a visitor register and escort rules in critical areas.
- Entry monitoring, door alarms, periodic log reviews and prompt access revocation after a role change.
- Temperature, humidity, smoke and water sensors with thresholds, an alert channel and a response owner.
- UPS, generator and redundant power with failover tests covering systems important to business continuity.
- Locked cabinets, media control, asset inventory and secure equipment removal or disposal procedures.
Technical security controls
Technical controls operate in hardware, software and firmware. They should form a coherent chain from identity and device through network and application to data, logs and recovery. A tool without configuration, alert handling and regular testing is not evidence of an effective control.
Identity and access
Individual accounts, groups, MFA, access lifecycle, privileged accounts and periodic recertification.
Endpoint and network
EDR, updates, hardening, firewall, segmentation, IDS/IPS and device and media control.
Data and recovery
Encryption, DLP, retention, segregated backup, RPO/RTO and a documented restore test.
ISO/IEC 27001 - information security management
The official ISO page introduces requirements for an information security management system and risk-based improvement.
Administrative and organisational controls
Policy explains why a control exists, who owns it and when action is required. Procedures connect management, data owners, IT, HR, suppliers and users. Without this layer, a technical alert may lack an owner and physical access may not be revoked on time.
- Information classification, data owners and handling rules aligned with risk and customer contracts.
- A joiner-mover-leaver process for granting, changing, recertifying and revoking physical and logical access.
- Management of change, updates, exceptions, vulnerabilities, suppliers and owner-accepted risk.
- Training, phishing tests, incident reporting and continuity exercises for technical and business roles.
- Incident procedure, escalation contacts, communication, evidence preservation and post-event review.
How to select a control and test effectiveness
Not every organisation needs an identical set. Selection follows from assets, threats, business impact, legal and contractual requirements and operational capacity. A good control has measurable acceptance criteria and is reassessed after changes to a system, process, supplier or risk.
- Describe the risk scenario, asset, business owner, likelihood and possible business impact.
- Select preventive, detective and corrective controls and check that they do not share one point of failure.
- Define evidence of operation, such as a log, report, configuration capture, recovery test, protocol or ticket.
- Set monitoring, test and review frequency and the threshold that triggers an incident or corrective plan.
- Record the result, residual risk, decision owner, remediation deadline and retest method.
Related Virtline areas
A control review can be a standalone workshop or part of an audit, ISO 27001 implementation, NIS2 programme, managed IT service or cybersecurity project. It should end with a list of evidence, gaps and owners.
ISO 27001 gap assessment
A gap assessment of controls and documentation before implementation or preparation for certification. This assessment is not a certification audit and does not award a certificate.
Cybersecurity
Review of identities, endpoints, networks, applications, logs, vulnerabilities and incident response.
IT monitoring
Service, infrastructure and environment parameters with thresholds, alerts, tickets and trend reports.
