The Cybersecurity Control Playbook

Appendix AGlossary of Terms

Administrative Control

These are non‐technical controls such as policies, procedures, and guidelines that govern how security is managed in an organization. Examples include security awareness training and incident response plans.

Automated Control Testing

Automation tools are used to test controls, continuously reducing the need for manual intervention. This increases efficiency and ensures that control weaknesses are identified quickly, minimizing the risk of oversight.

Common Control

A control applied across multiple areas of an organization, addressing shared risks. For example, encryption used organization‐wide to protect data is a common control that provides consistent security across departments.

Compensating Control

An alternative control used when the primary control is unavailable or infeasible. For example, if multi‐factor authentication can't be used, a compensating control might involve stricter monitoring of login attempts.

Control Design

This is planning how a control will work, including determining how it fits with other security measures. Proper design ensures that the control addresses the intended risks effectively and is easy to manage.

Control Documentation

Detailed records that describe how controls are designed, implemented, and monitored. Proper documentation is essential for audits and ensures all relevant stakeholders understand the control's operation.

Control Environment

The overall context in which controls operate, ...