{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/organisational-control","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/organisational-control/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/organisational-control/"},"term":{"en":"Organisational control","da":"Organisatorisk kontrol"},"aka":{"en":["organizational control","administrative control"],"da":["organisatorisk foranstaltning","administrativ kontrol"]},"domain":["security"],"cluster":"controls","layer":"governance","status":"current","summary":{"en":"A safeguard made of rules, roles and routines - who decides, who does what, and how work must be done.","da":"En beskyttelse, der består af regler, roller og rutiner - hvem der beslutter, hvem der gør hvad, og hvordan arbejdet skal udføres."},"body":{"formal":{"en":"A security control carried out through policies, processes, responsibilities and agreements - such as supplier management, access approval or an incident process - one of the four control themes in ISO 27002.","da":"En sikkerhedskontrol, der udføres gennem politikker, processer, ansvar og aftaler - fx leverandørstyring, godkendelse af adgang eller en hændelsesproces - et af de fire kontroltemaer i ISO 27002."},"plain":{"en":"Like the plan for a school trip - the teacher counts heads at every stop, children walk in pairs, and nobody leaves the group without telling an adult. No fence is needed.","da":"Som planen for en skoleudflugt - læreren tæller børnene ved hvert stop, de går to og to, og ingen forlader gruppen uden at sige det til en voksen. Der skal ikke noget hegn til."},"inPractice":{"en":"A housing association writes down that a new user account needs the head of department's approval and that HR tells the IT department the same day someone leaves.","da":"Et boligselskab skriver ned, at en ny brugerkonto kræver godkendelse fra afdelingslederen, og at HR giver IT-afdelingen besked samme dag, som nogen stopper."},"whyItMatters":{"en":"It is the largest group of controls in ISO 27002, and without clear rules and owners even good technology is set up and used at random.","da":"Det er den største gruppe kontroller i ISO 27002, og uden klare regler og ejere bliver selv god teknologi sat op og brugt tilfældigt."}},"deepDive":{"en":"ISO/IEC 27002:2022 restructured its control set into four themes: organisational (clause 5, 37 controls), people (clause 6, 8 controls), physical (clause 7, 14 controls) and technological (clause 8, 34 controls), 93 in total, mirrored one-to-one in Annex A of ISO/IEC 27001:2022. The organisational theme is a residual category in the sense that it holds every control that is not primarily about individuals, premises or technology: information security policies (5.1), roles and responsibilities (5.2), segregation of duties (5.3), management responsibilities (5.4), threat intelligence (5.7, new in 2022), asset inventory and acceptable use (5.9-5.11), classification and labelling (5.12-5.13), access control and identity management (5.15-5.18), the supplier and cloud chain (5.19-5.23), incident management (5.24-5.28), security during disruption and ICT readiness for business continuity (5.29-5.30), legal, privacy and policy compliance with independent review (5.31-5.36) and documented operating procedures (5.37).\n\nThe theme describes where a control is implemented, not how it acts. ISO 27002:2022 adds attributes as a separate axis - control type (preventive, detective, corrective), information security properties, cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities and security domains - so an organisational control can be detective (an access review) or corrective (an incident process). The older triad of administrative, technical and physical controls, still common in US literature and in the HIPAA Security Rule's administrative, physical and technical safeguards, maps roughly but not exactly: \"administrative\" covers both ISO's organisational and people themes.\n\nIn European law the same idea appears as \"technical and organisational measures\" (TOMs), required by GDPR Art. 32 and Art. 25 and by NIS2 Art. 21(1), which speaks of \"appropriate and proportionate technical, operational and organisational measures\". Data processing agreements (databehandleraftaler) under GDPR Art. 28 usually include an annex listing the processor's TOMs, which the controller must be able to show are adequate if Datatilsynet or another supervisory authority asks.\n\nThe characteristic weakness of organisational controls is the gap between design and operation. A policy that exists but is not followed, a supplier-assessment procedure that is never triggered, or an approval workflow that is routinely bypassed looks compliant on paper. Auditors therefore test both design effectiveness (would the control address the risk if followed?) and operating effectiveness over a period, for example in ISAE 3402 type 2 or SOC 2 type II reports, by sampling evidence such as signed approvals, review records and meeting minutes. Organisational controls are strongest when they are backed by technical enforcement - an access request workflow that is the only way to obtain a role, for example - rather than relying on people remembering the rule.","da":"ISO/IEC 27002:2022 omstrukturerede kontrolsættet i fire temaer: organisatoriske (afsnit 5, 37 kontroller), menneskelige (afsnit 6, 8 kontroller), fysiske (afsnit 7, 14 kontroller) og teknologiske (afsnit 8, 34 kontroller), i alt 93, spejlet én til én i Annex A i ISO/IEC 27001:2022. Det organisatoriske tema er en restkategori i den forstand, at det rummer alle kontroller, der ikke primært handler om personer, lokaler eller teknologi: informationssikkerhedspolitikker (5.1), roller og ansvar (5.2), funktionsadskillelse (5.3), ledelsens ansvar (5.4), trusselsefterretninger (5.7, ny i 2022), aktivfortegnelse og acceptabel brug (5.9-5.11), klassifikation og mærkning (5.12-5.13), adgangsstyring og identitetsstyring (5.15-5.18), leverandør- og cloudkæden (5.19-5.23), hændelseshåndtering (5.24-5.28), sikkerhed under forstyrrelser og IKT-parathed til driftskontinuitet (5.29-5.30), overholdelse af lovgivning, privatlivskrav og politikker med uafhængig gennemgang (5.31-5.36), og dokumenterede driftsprocedurer (5.37).\n\nTemaet beskriver, hvor en kontrol er forankret, ikke hvordan den virker. ISO 27002:2022 tilføjer attributter som en selvstændig akse - kontroltype (forebyggende, detekterende, korrigerende), informationssikkerhedsegenskaber, cybersikkerhedsbegreber (identify, protect, detect, respond, recover), operationelle kapabiliteter og sikkerhedsdomæner - så en organisatorisk kontrol kan være detekterende (en rettighedsgennemgang) eller korrigerende (en hændelsesproces). Den ældre tredeling i administrative, tekniske og fysiske kontroller, der stadig er udbredt i amerikansk litteratur og i HIPAA Security Rules administrative, fysiske og tekniske safeguards, svarer nogenlunde, men ikke præcist: \"administrativ\" dækker både ISO's organisatoriske og menneskelige tema.\n\nI europæisk ret optræder samme idé som \"tekniske og organisatoriske foranstaltninger\", som kræves af databeskyttelsesforordningens art. 32 og art. 25 og af NIS2 art. 21, stk. 1, der taler om \"passende og forholdsmæssige tekniske, operationelle og organisatoriske foranstaltninger\". Databehandleraftaler efter forordningens art. 28 indeholder typisk et bilag med databehandlerens foranstaltninger, og den dataansvarlige skal kunne dokumentere over for Datatilsynet, at de er tilstrækkelige.\n\nDen typiske svaghed ved organisatoriske kontroller er kløften mellem design og drift. En politik, der findes, men ikke følges, en procedure for leverandørvurdering, der aldrig sættes i gang, eller et godkendelsesflow, der rutinemæssigt omgås, ser compliant ud på papiret. Revisorer tester derfor både designeffektivitet (ville kontrollen håndtere risikoen, hvis den blev fulgt?) og operationel effektivitet over en periode, fx i ISAE 3402 type 2- eller SOC 2 type II-erklæringer, ved at udtage stikprøver af dokumentation som underskrevne godkendelser, gennemgangslogs og mødereferater. Organisatoriske kontroller står stærkest, når de understøttes af teknisk håndhævelse - fx et flow for adgangsanmodninger, der er den eneste vej til en rolle - frem for at bero på, at folk husker reglen."},"edges":[{"type":"requires","to":"security/governance","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/people-control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/physical-security","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/technical-control","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-policy","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 1 og Ordliste (Kontrol)","tier":"course-material"},{"title":"ISO/IEC 27002:2022 (clause 5 - Organizational controls)","tier":"standard"}],"draft":true}