Control
A control is a measure that keeps a risk in check: a policy, a process, a technical setting, a physical lock or a review that someone carries out. Frameworks agree on that much, then use the word differently. Read which one you are working to before you count your controls.
- Clauses
- ISO 27001:2022 6.1.3 b) · SOC 2 CC6.1 · Cyber Essentials, user access control
Where the term appears
In ISO 27001 a control is something your risk treatment needs. ISO 27001:2022 6.1.3 b) asks you to determine the controls each treatment requires, from Annex A or from anywhere else. In SOC 2 the criterion and the control are different things: SOC 2 CC6.1 states an outcome for logical access, and the controls are the specific things you design to meet it, which the auditor then tests. The five Cyber Essentials technical controls are fixed requirements with no risk-based opt-out. Under Cyber Essentials, user access control applies to every device and cloud service in scope.
Designed, then operating
An auditor tests two things about a control: that it is designed to address the risk, and that it actually ran. A written access review procedure is a design; four quarterly review records are the operation. The SOC 2 common criteria page explains how criteria and controls meet.
How Sted uses it
- Each Statement of Applicability card on the Summary lists the standard’s controls by theme as Applicable, Excluded or Not addressed, with any exclusion reason, the implementation status and when each was last verified; below administrator it is marked as a partial view, and its PDF needs a paid plan.
- For Cyber Essentials, the Statement of Applicability card lists the scheme’s five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
- Only standards with a control catalogue get a Statement of Applicability card.
Related terms
- Annex A: the ISO 27001 reference list of controls.
- Statement of Applicability: where each control is applied or excluded.
- Trust services criteria: the SOC 2 outcomes your controls must meet.
- Evidence: what shows a control operated.
- Risk treatment plan: how new controls get put in place.