Control

A control is a specific measure put in place to achieve a security or operational outcome, such as requiring multi-factor authentication or reviewing access quarterly. Audits assess whether controls are designed appropriately and, in a Type II, whether they actually operated.