Security controls are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information.
Systems of controls can be referred to as frameworks or standards. Frameworks can enable an organization to manage security controls across different types of assets with consistency.
Types of security controls
Security controls can be classified by various criteria. For example, controls are occasionally classified by when they act relative to a security breach: Before the event, preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders; During the event, detective controls are intended to identify and characterize an incident in progress e.g. by sounding the intruder alarm and alerting the security guards or police; After the event, corrective controls are intended to limit the extent of any damage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible.
Security controls can also be classified according to their characteristics, for example: Physical controls e.g. fences, doors, locks and fire extinguishers; Procedural or administrative controls e.g. incident response processes, management oversight, security awareness and training; Technical or logical controls e.g. user authentication (login) and logical access controls, antivirus software, firewalls; Legal and regulatory or compliance controls e.g. privacy laws, policies and clauses.
For more information on security controls in computing, see Defense in depth (computing) and Information security
Information security standards and control frameworks
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Some of the most well known standards are outlined below.
International Standards Organization
ISO/IEC 27001:2022 was released in October 2022. All organizations certified to ISO 27001:2013 are obliged to transition to the new version of the Standard within 3 years (by October 2025).
The 2022 version of the Standard specifies 93 controls in 4 groups: A.5: Organisational controls A.6: People controls A.7: Physical controls A.8: Technological controls
It groups these controls into operational capabilities as follows: Governance Asset management Information protection Human resource security Physical security System and network security Application security Secure configuration Identity and access management Threat and vulnerability management Continuity Supplier relationships security Legal and compliance Information security event management; and Information_security_assurance
The previous version of the Standard, ISO/IEC 27001, specified 114 controls in 14 groups: A.5: Information security policies A.6: How information security is organised A.7: Human resources security - controls that are applied before, during, or after employment. A.8: Asset management A.9: Access controls and managing user access A.10: Cryptographic technology A.11: Physical security of the organisation's sites and equipment A.12: Operational security A.13: Secure communications and data transfer A.14: Secure acquisition, development, and support of information systems A.15: Security for suppliers and third parties A.16: Incident management A.17: Business continuity/disaster recovery (to the extent that it affects information security) A.18: Compliance - with internal requirements, such as policies, and with external requirements, such as laws.'''
U.S. Federal Government information security standards
The Federal Information Processing Standards (FIPS) apply to all US government agencies. However, certain national security systems, under the purview of the Committee on National Security Systems, are managed outside these standards.
Federal information Processing Standard 200 (FIPS 200), "Minimum Security Requirements for Federal Information and Information Systems," specifies the minimum security controls for federal information systems and the processes by which risk-based selection of security controls occurs. The catalog of minimum security controls is found in NIST Special Publication SP 800-53.
FIPS 200 identifies 17 broad control families: