Information Security Program · Topic 3 of 6
Control Design, Implementation and Testing
Selecting controls by risk and cost, control categories and types, defense in depth, integrating controls into processes, and testing their effectiveness.
- 3 min
- Administrative, technical and physical; preventive, detective, corrective, deterrent, compensating.
- Select controls from risk, with cost-benefit and business fit.
- Defense in depth avoids single points of failure.
What it is
Controls are the policies, processes, technologies and physical measures that reduce risk. The information security manager makes sure controls are designed and selected to treat assessed risks cost-effectively, implemented and integrated into business and IT processes, and tested and evaluated so management knows they work.
How it works
Control categories and types
| By nature | Examples |
|---|---|
| Administrative (managerial) | Policies, procedures, training, segregation of duties |
| Technical (logical) | Access control, encryption, firewalls, logging |
| Physical | Locks, badges, cameras, environmental controls |
| By function | Purpose |
|---|---|
| Preventive | Stop an event |
| Detective | Identify an event |
| Corrective | Limit damage and restore |
| Deterrent | Discourage an attempt |
| Compensating | Reduce risk when the preferred control is not feasible |
Selecting controls
- Start from a control objective linked to a risk.
- Compare options by cost against risk reduction; a control should not cost more than the risk it reduces, unless the law requires it.
- Prefer controls that fit business processes and that people will actually use.
- Use defense in depth: several layers so one failure does not expose the asset.
- Consider baselines: minimum control sets for system types, applied consistently.
- Record why controls were chosen, so decisions can be reviewed.
Implementing and integrating controls
Controls work best when built into existing processes:
| Process | Integration |
|---|---|
| Projects and development | Security requirements at the start; security review before go-live |
| Procurement | Security requirements in contracts and supplier assessments |
| Change management | Security impact assessed for changes |
| Human resources | Screening, onboarding, role changes and termination |
Each control has an owner responsible for its operation. New controls are introduced with communication and training, and their impact on operations is planned.
Testing and evaluating controls
| Method | What it shows |
|---|---|
| Design review | Whether the control, if it works, would meet its objective |
| Operating effectiveness testing | Whether it works consistently over time (samples, reperformance) |
| Vulnerability scanning and penetration testing | Whether technical controls resist attack |
| Control self-assessment | Owners' own evaluation, supporting independent testing |
| Internal and external audit | Independent assurance |
| Continuous monitoring | Ongoing evidence from tools and metrics |
Results feed back into the risk register: a failed control raises residual risk until it is fixed.
When a question describes a control that exists on paper but is not followed, the issue is operating effectiveness. Testing evidence, not policy documents, shows whether a control works.
How the exam asks about this
- "What should drive control selection?" The risk assessment and control objectives, weighed against cost.
- "A security tool is installed but alerts are never reviewed." The control is not effective; assign ownership and a process.
- "How can security be built into new systems?" Integrate requirements into the project life cycle from the start.
What to remember for the exam
- Administrative, technical and physical; preventive, detective, corrective, deterrent, compensating.
- Select controls from risk, with cost-benefit and business fit.
- Defense in depth avoids single points of failure.
- Integrate controls into projects, procurement, change and HR.
- Test design and operating effectiveness; update residual risk.
Adding controls without removing ones that no longer reduce risk increases cost and friction, and teams start to bypass all of them.
Common mistakes
Choosing the strongest control regardless of cost.
Bolting security on at the end of a project.
Assuming a documented control is working.
Check yourself
What is a compensating control?
A control that reduces risk when the preferred control cannot be implemented.
What does operating effectiveness testing show?
Whether a control works consistently over a period, not just whether it is designed correctly.
Why integrate security into change management?
So the security impact of changes is assessed before they are made.
Topic 3 of 6 in Information Security Program
Test yourself on Information Security Program
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.