Skip to main content
Governance Authority
Category: Policy and Document Management

Standards and Controls

Also known as: security controls, controls and standards
Simply put

Standards are agreed-upon criteria or specifications that describe how something should be done, while controls are the specific safeguards or measures an organization puts in place to meet those criteria and reduce risk. In an information security context, controls are the practical steps taken to protect the confidentiality, integrity, and availability of systems and data. Standards typically set the expectations, and controls are how an organization works to satisfy them.

Formal definition

In the security and compliance domain, a control is a safeguard or countermeasure prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of information and to satisfy requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, and standards. Standards function as the criteria or specifications against which controls are designed, implemented, and evaluated. Frameworks such as NIST SP 800-53 provide catalogs of security and privacy controls, while the CIS Critical Security Controls express controls as discrete safeguards; access control is one commonly referenced control category. The specific controls and standards an entity must apply vary by jurisdiction, sector, and regulatory regime, and some standards are binding compliance obligations while others are voluntary best-practice frameworks. This entry is educational and not legal, audit, or compliance advice; distinctions such as control design versus operating effectiveness and which function owns a given control depend on an organization's own facts and governance structure.

Why it matters

Standards and controls form the operational backbone of an information security and compliance program. Standards articulate the criteria or specifications an organization is expected to meet, while controls are the concrete safeguards and countermeasures that translate those expectations into practice. Without clearly defined standards, an organization has no consistent benchmark against which to design, implement, and evaluate its protective measures; without effective controls, standards remain aspirational statements rather than working defenses for the confidentiality, integrity, and availability of systems and data.

The distinction also matters for accountability and assurance. Some standards represent binding compliance obligations imposed by laws, regulations, or listing rules, while others are voluntary best-practice frameworks an organization adopts to strengthen its posture. Which standards apply, and how rigorously, varies by jurisdiction, sector, and regulatory regime. Boards and management need to understand this difference so they can allocate resources appropriately and avoid treating a voluntary framework as though it carried the force of law, or conversely overlooking a genuine legal requirement.

A further consideration is that adopting a control on paper is not the same as operating it effectively. The distinction between control design and operating effectiveness is central to any credible assurance activity: a well-designed control that is not consistently performed provides limited protection. This entry is educational and not legal, audit, or compliance advice; the specific controls an entity must apply, and the function that owns each, depend on the organization's own facts and governance structure.

Who it's relevant to

Chief Information Security Officers and Security Teams
Security leaders rely on standards to define what good looks like and on controls to operationalize protection of confidentiality, integrity, and availability. They typically select controls from catalogs such as NIST SP 800-53 or the CIS Critical Security Controls and map them to applicable requirements, distinguishing binding obligations from voluntary best practice.
Chief Compliance Officers
Compliance leaders are concerned with whether the organization's controls satisfy the standards that represent binding obligations under applicable laws, regulations, and policies. They generally track how requirements vary by jurisdiction and sector and monitor whether controls are in place, while accountability for operating those controls typically sits with management.
Internal Auditors and Assurance Functions
Auditors and other assurance providers evaluate whether controls are both well designed and operating effectively against the relevant standards. This distinction is central to their work: a control that exists on paper but is not consistently performed does not provide the intended protection, and identifying that gap is part of the assurance role rather than the operational one.
Boards and Risk Committees
Boards and their committees exercise oversight of the organization's control environment rather than operating controls themselves. They generally seek assurance that appropriate standards have been identified, that controls address applicable legal and best-practice requirements, and that management is accountable for implementation, without assuming operational duties that belong to management.
IT and Access Management Personnel
Staff responsible for systems and access management implement and maintain specific controls, such as access control, that support movement management around facilities or networks. They translate the specifications set by standards into day-to-day safeguards and are often closest to whether a control operates as intended.

Inside Standards and Controls

Standards
Documented expectations that set the required level of performance, conduct, or quality against which activities are measured. Standards may derive from binding sources (statutes, regulations, listing rules) or non-binding sources (recognized frameworks, industry codes, internal policy). The authority and enforceability of a given standard depends on its source, and applicability typically varies by jurisdiction, sector, and entity type.
Controls
The processes, activities, and mechanisms designed and operated to provide reasonable assurance that objectives are met and that applicable standards are adhered to. Controls are commonly owned and operated by management in the first line, while assurance over their design and effectiveness may be provided by other functions.
Control design
Whether a control, if operating as intended, is capable of preventing or detecting the risk it addresses. Design assessment considers whether the right control exists at the right point; it is distinct from and does not by itself confirm operating effectiveness.
Operating effectiveness
Whether a well-designed control actually functions consistently over a period as intended. A control can be properly designed yet fail in operation, so operating effectiveness is evaluated separately from design.
Preventive and detective controls
Preventive controls aim to stop an error or breach before it occurs, while detective controls identify issues after they arise so they can be corrected. Most control environments rely on a mix, and the appropriate balance generally depends on the risk and the entity's judgment.
Binding versus voluntary standards
A distinction between requirements imposed by law or regulation and standards adopted voluntarily through frameworks or best practice. Frameworks such as COSO or ISO 31000 provide structured approaches to internal control and risk management respectively, but they are not universally mandatory; whether any framework applies depends on jurisdiction, sector, listing status, and the entity's own choices.
Ownership and accountability
Clarity over who sets a standard, who operates the related controls, and who provides independent assurance. Management typically owns and operates controls, the board and its committees typically oversee the adequacy of the control environment, and assurance functions evaluate rather than operate controls.

Common questions

Answers to the questions practitioners most commonly ask about Standards and Controls.

Are standards and controls the same thing?
No. A standard is a stated expectation, requirement, or benchmark against which conduct or performance is measured, whereas a control is a specific mechanism, activity, or safeguard put in place to achieve conformance with that standard or to mitigate a particular risk. In practice a single standard is typically supported by multiple controls, and a control has meaning only in relation to the standard or risk it addresses. Treating the two as interchangeable tends to obscure where a gap actually lies: a weakness may sit in the standard itself (unclear or absent expectation) or in the controls intended to give effect to it (poorly designed or ineffectively operating). These entries are educational and not legal, audit, or compliance advice.
Does having a control documented mean the control is working?
Not necessarily. Documentation typically evidences control design, how a control is intended to operate and whether, if performed as described, it would address the relevant risk. It does not by itself demonstrate operating effectiveness, which concerns whether the control actually operated as designed throughout the relevant period. A control can be well designed on paper yet fail in operation because it is not consistently performed, is overridden, or is applied by someone without the necessary authority or competence. Distinguishing design from operating effectiveness is central to most assurance work, and conclusions on either generally depend on the facts and the evidence available.
How should an organization decide what standards to adopt?
Standards generally derive from a combination of sources: binding law and regulation applicable to the entity's jurisdiction and sector, listing rules where relevant, contractual obligations, and voluntary frameworks or codes the organization chooses to align with. A common approach is to first identify mandatory requirements, then layer voluntary standards where they support the entity's risk profile and objectives. Which framework is appropriate depends on the entity type, sector, jurisdiction, and the judgment of those accountable. No single framework is universally mandatory, and adopting one does not discharge distinct legal obligations that may apply.
Who is responsible for designing, operating, and assuring controls?
Responsibility is typically distributed across roles. Management generally owns the design and operation of controls as part of running the business, since controls are embedded in day-to-day processes. Compliance and risk functions often set expectations, monitor, and advise, while independent assurance functions such as internal audit typically provide objective evaluation of whether controls are designed and operating effectively rather than operating the controls themselves. The board and its committees generally hold an oversight role, satisfying themselves that an adequate system exists, without assuming operational responsibility. The precise allocation varies by entity and by the model an organization adopts.
How often should standards and controls be reviewed?
There is no single required frequency; the appropriate cadence generally depends on the risk being addressed, the rate of change in the environment, and any applicable regulatory expectations. Higher-risk or rapidly changing areas typically warrant more frequent review, while stable areas may be reviewed on a longer cycle. Reviews are also commonly triggered by events such as regulatory change, significant incidents, restructuring, or new lines of business. Whether a given cadence is adequate is a matter of professional judgment and, in some regimes, of specific requirements that vary by jurisdiction and sector.
What is the difference between a control gap and a control failure, and how should each be handled?
A control gap generally refers to the absence of a control needed to address a risk or standard, or a deficiency in control design, whereas a control failure typically refers to a control that exists and is designed appropriately but did not operate as intended. Remediation differs accordingly: a gap usually calls for designing and implementing a new or strengthened control, while a failure often calls for investigating why the control did not operate and reinforcing its operation. Both are commonly logged, assessed for severity based on likelihood and impact, assigned an owner, and tracked to resolution, with the depth of response depending on the facts and the organization's own thresholds.

Common misconceptions

A control that is well designed is automatically effective.
Design and operating effectiveness are separate. A control may be soundly designed yet fail in practice because it is not performed consistently, is overridden, or is applied to the wrong population. Both dimensions generally need to be assessed.
Adopting a recognized framework such as COSO or ISO 31000 is legally required.
These frameworks are structured, widely used tools, but they are generally voluntary standards rather than binding law. Whether an entity must apply a particular framework or standard depends on jurisdiction, sector, listing rules, and entity type, and some regulatory regimes reference frameworks without mandating one universally.
Controls provide a guarantee that objectives will be met and breaches prevented.
Controls are designed to provide reasonable, not absolute, assurance. Limitations such as human error, management override, and cost-benefit trade-offs mean residual risk typically remains even where controls operate as intended.

Best practices

Document each standard's source and note whether it is a binding legal requirement or a voluntary framework or policy, since applicability generally varies by jurisdiction, sector, and entity type.
Assess control design and operating effectiveness separately, and avoid concluding a control works based on design alone.
Map each significant control to the risk it addresses and to a clearly identified owner, distinguishing who operates the control from who provides independent assurance.
Use a considered mix of preventive and detective controls calibrated to the underlying risk rather than defaulting to one type.
Where a framework such as COSO or ISO 31000 is adopted, apply it to its intended scope and purpose without overstating its reach or treating it as a substitute for applicable legal requirements.
Recognize that controls offer reasonable rather than absolute assurance, and periodically revisit standards and controls as risks, regulations, and the entity's circumstances change; treat these entries as educational and not legal, audit, or compliance advice.