A security control is a measure used to manage cybersecurity risk. Controls protect assets by deterring threats, identifying trouble, or helping repair damage. The useful question is not simply how many controls exist, but whether the right protections are in place for critical assets at a reasonable cost. section 7.1.9
Classify a control in two ways: by what it is and by what it does.
- Type: physical controls are tangible measures; technical controls use technology; administrative controls include policies, procedures, and compliance measures. section 7.1.9
- Function: preventive controls deter or avoid threats, detective controls identify them, and corrective controls address damage. A fence, camera, and replacement access card illustrate the three functions. section 7.1.9
Frameworks offer different ways to choose and assess controls. HITRUST prescribes controls, implementation, measurement, and management, then scores adherence through a validated assessment. NIST Cybersecurity Framework 2.0 instead guides organizations toward flexible controls tailored to their risks across govern, identify, protect, detect, respond, and recover. section 1.5.1 section 1.5.3
Turn a control gap into a decision
A healthcare organization reports 85% encryption compliance and targets full coverage by the end of the next quarter. The remaining unencrypted data is an actionable control gap, not just a percentage: prioritize it to address the stated HIPAA requirement. Give the CISO the control status and remediation target; give the CEO the implications for assets, significant risk, and business objectives. section 4.2.5
Measure whether oversight leads to improvement. Gap-analysis coverage rising from 60% to 85% increases visibility, but does not show that identified gaps were fixed. Pair coverage with resolution and closure data. Continuous monitoring can also analyze logs, network traffic, application activity, and user behavior to assess control effectiveness and guide responses. section 5.6.5 section 8.1.2
Table 1.3 NIST CSF v2.0 with six main functions and categories
| Category |
Function |
| Govern |
Organizational context Risk management Supply-chain risk Roles and responsibilities Policies and procedures Oversight |
| Identify |
Asset management Risk management Improvement |
| Protect |
Access control Awareness and training Data security Platform security Infrastructure resilience |
| Detect |
Continuous monitoring Adverse event analysis |
| Respond |
Incident response Incident analysis Incident reporting Incident mitigation |
| Recover |
Incident recovery Incident communication |
Use the NIST CSF 2.0 function-and-category table to locate control work within the broader risk-management lifecycle, from access control and monitoring to incident mitigation and recovery. section 1.5.3
