Cybersecurity is not one product, one policy, or one person's responsibility.
It is a collection of safeguards working together to protect the information and systems your business depends on.
Those safeguards are controls.
A control might require multifactor authentication. Another might define how access is removed when an employee leaves. Others address backups, suppliers, security awareness, incident response, physical access, vulnerabilities, or how information should be handled.
Some controls are performed by technology. Some are performed by people.
The strongest security programs depend on both.
What is a control?
At its simplest, a control is something you put in place to reduce risk.
If unauthorized access is a risk, access controls help reduce it.
If losing critical information is a risk, backup controls help protect it.
If an employee clicking a malicious link is a risk, awareness and email security controls help reduce it.
If a critical vendor creates risk, supplier security controls help manage it.
If an incident occurs, response controls help make sure the organization knows what to do next.
Controls turn security from an intention into action.
Risks & Threats tell you what could go wrong.
Controls are what you do about it.
More than technology
It is easy to think of cybersecurity as firewalls, antivirus software, passwords, and security products.
Those things matter, but protecting a business requires more.
ISO/IEC 27001:2022 organizes its 93 Annex A controls into four themes: Organizational, People, Physical, and Technological. The current structure contains 37 Organizational controls, 8 People controls, 14 Physical controls, and 34 Technological controls.
Together, they encourage an organization to look beyond technology and consider how security operates across the entire business.
Organizational
37 controls
How does the company govern and manage security?
These controls address areas such as responsibilities, policies, information assets, suppliers, cloud services, incidents, continuity, legal requirements, and other organizational security practices.
They help answer:
Do we know what we are responsible for, who owns it, and how we manage it?
People
8 controls
People can strengthen security or unintentionally weaken it.
These controls address responsibilities before, during, and after employment, awareness and training, confidentiality, remote working, and reporting security events.
They help answer:
Do our people understand their responsibilities and have what they need to protect the organization?
Physical
14 controls
Information does not exist only in the cloud.
Facilities, offices, equipment, storage, devices, and physical access can all create security risk.
These controls help organizations think about who can physically access sensitive areas and equipment and how those environments are protected.
They help answer:
Can the wrong person physically reach something we are trying to protect?
Technological
34 controls
This is where many familiar cybersecurity capabilities appear.
Identity and access, authentication, privileged access, endpoints, malware protection, vulnerabilities, backups, logging, monitoring, networks, encryption, secure development, configuration, and other technical safeguards all contribute to protecting information.
They help answer:
Is our technology configured and operating in a way that protects the business?
Risk
Control
Owner
Process
Evidence
Insight
Action
You do not need certification to benefit from good controls
ISO/IEC 27001 certification can provide independent assurance that an organization has established and operates an information security management system meeting the standard's requirements.
But certification does not have to be your objective to benefit from the framework.
ISO specifically recognizes that some organizations implement ISO/IEC 27001 for the practices it provides without pursuing certification.
The same questions still matter.
Who has access to your information?
Are your endpoints protected?
Are backups working?
Are employees prepared for security threats?
Do you understand your critical vendors?
Can you detect and respond to an incident?
Do people know what they are responsible for?
Does leadership understand the organization's security risks?
A company does not need an auditor coming through the door for those questions to matter.
Good controls are good business practices before they are audit requirements.
Not every control is right for every organization
Security should reflect risk.
ISO/IEC 27001 does not simply require every organization to implement the same 93 controls in exactly the same way. Organizations determine the controls needed to address their risks and compare those controls against Annex A to help ensure necessary safeguards have not been overlooked.
That distinction matters.
A ten person software company does not operate like a hospital, manufacturer, financial institution, or multinational enterprise.
The objective is not to collect controls. It is to understand your risks and put appropriate safeguards around the things that matter.
A control needs an owner
Technology does not own security. People do.
In Trygg, each applicable control connects to a leader responsible for making sure the control operates as intended.
That does not necessarily mean the leader personally performs every task.
It means someone knows the answer when leadership asks:
Who is responsible for this?
Clear ownership changes controls from documentation into accountability.
A control needs a process
Knowing who owns something is only the beginning.
How does your company actually perform the control?
That is the process.
If access must be removed when someone leaves the company, who tells IT? How quickly should access be removed? Which systems need attention? Who verifies completion?
The process connects the requirement to the way your company actually works.
Trygg does not want a generic description of how some company could perform the control.
We want to understand how your company does it.
A control needs evidence
Then comes the question that separates intention from operation:
Can we demonstrate that it happened?
Evidence might come from a security platform, identity system, backup service, endpoint platform, completed review, meeting record, ticket, report, training system, or another reliable source.
Where possible, Trygg connects operational evidence directly to the systems performing or measuring the work.
That creates a simple relationship:
Owner → Process → Evidence
Who is accountable?
How is it performed?
What demonstrates that it is working?
That is how a control becomes something leadership can understand and an auditor can follow.
Controls work together
A single control rarely protects the organization by itself.
Consider a compromised password.
Identity controls may require multifactor authentication.
Access controls limit what the compromised account can reach.
Privileged access controls provide additional protection around powerful accounts.
Logging and monitoring may help detect unusual behavior.
Incident response establishes what happens if suspicious activity is discovered.
Training helps employees recognize how credentials may be stolen in the first place.
Each control creates another layer.
No individual safeguard makes an organization invulnerable.
Together, they make attacks more difficult, improve the opportunity to detect problems, reduce potential impact, and help the organization recover when something does happen.
From 93 controls to one security program
Ninety three controls can sound like ninety three separate projects.
They should not be.
Trygg connects controls to the risks, people, processes, technologies, and evidence already operating across your organization.
That allows leadership to move beyond:
Do we have this control?
and begin asking:
Is it working?
Who owns it?
What does the evidence tell us?
Where are the gaps?
What needs our attention?
That is when a control framework becomes a management tool.
A gap is something you and Trygg can both see, assign, and close. Progress is that list getting shorter, with evidence on each item that is done.
Controls are not about passing an audit
An auditor may eventually test your controls.
An attacker will not wait for the audit.
That is why we believe controls should be built first for the organization they protect.
Certification can validate the management system.
Controls are what help make the organization safer every day.
Whether your goal is ISO/IEC 27001 certification, stronger customer assurance, better cyber insurance conversations, improved leadership visibility, or simply becoming more difficult to compromise, a well designed control environment provides a disciplined place to start.
Understand the risk. Establish the control. Assign the owner. Follow the process. Prove it works. Improve it when it does not.
