What are compliance controls?

A control is a specific safeguard an organization puts in place to meet a requirement in a security framework. SOC 2 engagements typically involve 60 to 100 controls depending on scope, ISO 27001's Annex A defines 93 reference controls, and HIPAA splits its requirements into administrative, physical, and technical safeguards.

Every control has three parts: an objective (what it is supposed to achieve), an implementation (the actual configuration, process, or policy), and evidence (proof it is working). "Encryption at rest is enforced for all production databases" is the objective. The database configuration itself is the implementation. A configuration export or screenshot from the cloud console is the evidence.

A worked example

Take access control. The objective might be "only authorized employees can access production systems." The implementation is your identity provider's role-based access policy. The evidence is an access review log showing who had access during the period and confirmation that anyone who left the company was deprovisioned within a set number of days. An auditor checks all three: does the policy exist, does the configuration match it, and does the evidence prove it held for the whole window.

A common mistake

Teams often write a control's policy language without matching it to what the system actually does. A policy says access is reviewed quarterly, but no review ticket exists for the last quarter. The gap between the documented control and the operating control is exactly what auditors are trained to find, and it is one of the most common sources of findings in a first-year audit.

How controls map to an audit

Auditors test two things for every control: design (is it built correctly) and operating effectiveness (did it actually work over the audit period). A Type I SOC 2 report or an ISO 27001 Stage 1 review only tests design. A Type II report or Stage 2 review tests both, which is why evidence needs to be collected continuously rather than assembled right before fieldwork.

Controls are the foundation of SOC 2 readiness and every ISO 27001 ISMS. For the access control family specifically, see how to meet SOC 2 CC6 access controls. For how controls land on engineering day to day, see SOC 2 for engineering teams.