Definition
A Security Control is an organisational, technical or procedural measure used to reduce Risk or limit the consequences of a security incident.
Human Explanation
Controls include firewalls, encryption and backups, but also procedures, training and Access Control.
Why it Matters
Suitable Controls reduce the likelihood and potential impact of a successful Attack.
Conceptual Boundary
A Control does not guarantee complete security. It is one element of Risk management.
Practical Perspective
Effective Controls follow Risk analysis and support organisational objectives instead of obstructing work.