Controls

What this part of the catalogue does

Clause 0.3 explains that a control is a measure that changes or maintains risk: a policy on its own maintains risk while compliance with it can modify risk, and several controls describe one generic measure applied in different risk settings. The document offers a generic mix of organizational, people, physical and technological controls drawn from internationally recognized good practice.

What it means when you fill the register

A control is anything that changes the likelihood or the effect of an incident: a policy, a procedure, an organisational structure, a technical setting, a physical barrier, a contract term. The introduction notes that controls can act before, during or after an incident, which is exactly the vocabulary the control type attribute later formalises. It also notes that a control which is not monitored is a claim rather than a fact. For the attribute record this is the sentence to keep beside the register: the attribute describes the control's effect, and the evidence describes whether it operates. Our control pages put the values and the evidence side by side for that reason. The same definition also explains why an attribute can be shared by two controls that look unrelated: a backup policy and a staff succession plan both protect availability, even though one is technological and the other organisational. The definition is doing the work, not the theme.

Ask three people what a control is and you will often get a policy, a tool and a test. The introduction's definition settles the argument: a control is whatever changes the likelihood or effect of an incident, so a policy can be a control, a tool can be part of one, and a test can be the evidence that one operates. That is the definition the attribute columns depend on. A register built on the tool definition produces values that describe products, and the coverage counts then flatter the organisation.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method