What is a security control?
A security control is a specific safeguard a company puts in place to manage a risk, such as revoking a leaver’s access within 24 hours, and that an auditor can ask you to prove is working.
Security control examples
- Access to production systems requires multi-factor authentication.
- Accounts of people who leave are removed within one business day.
- Every code change is reviewed by someone other than its author.
- Backups are restored in a test at least once a quarter.
- Managers review who has access to what every quarter.
Types of security controls
Controls are usually grouped by what they do. Preventive controls stop an incident, like multi-factor authentication. Detective controls notice one, like alerts on unusual logins. Corrective controls limit the damage afterwards, like a tested restore. A sound programme has some of each for every major risk.
Control vs policy
A policy states an intention: access is granted on least privilege. A control is the specific, checkable practice that delivers it: access requests are approved by the system owner and reviewed quarterly. Auditors test controls, and a policy with no controls behind it is only a document.
Owning and evidencing controls
SOC 2 controls are written by you rather than handed down as a fixed list, so each one should be specific enough to test. Every control needs a control owner who keeps it running and a source of evidence. Compliance as a Service for SMBs maps each generated policy to the controls it satisfies and tracks the evidence behind every control.
Last reviewed 2026-11-01.