Organisational control vs Technical control

Controls & technical basics

A safeguard made of rules, roles and routines - who decides, who does what, and how work must be done.

Formal

A security control carried out through policies, processes, responsibilities and agreements - such as supplier management, access approval or an incident process - one of the four control themes in ISO 27002.

In plain English

Like the plan for a school trip - the teacher counts heads at every stop, children walk in pairs, and nobody leaves the group without telling an adult. No fence is needed.

In practice

A housing association writes down that a new user account needs the head of department's approval and that HR tells the IT department the same day someone leaves.

Why it matters

It is the largest group of controls in ISO 27002, and without clear rules and owners even good technology is set up and used at random.

Technical control

Controls & technical basics

A safeguard built into hardware or software, which works automatically once it is set up.

Formal

A security control carried out by technology rather than by people or written rules - for example encryption, MFA, a firewall, backups or logging - one of the four control themes in ISO 27002.

In plain English

Like the automatic lock on a car that clicks shut when you walk away - it protects you whether or not you remember.

In practice

At a Danish university, the IT department no longer just asks staff not to plug in unknown USB sticks; it blocks them on every staff laptop through one central setting.

Why it matters

Machines apply a rule the same way every time, but a technical control set up wrongly gives false comfort, so it still needs rules and people around it.

Shared connections

Security control People control