Skip to content
atlas

Don't confuse these

People control vs Technical control

People control

Controls & technical basics

A safeguard aimed at staff themselves - screening, training, clear duties and what happens when someone joins or leaves.

Formal

A security control that works through the people in the organisation - background checks, terms of employment and confidentiality, awareness and training, reporting duties and the process when staff join, move or leave - one of the four control themes in ISO 27002.

In plain English

Like a kindergarten that checks a new helper's background, walks her through the daily routines on her first day and takes back her key when she leaves - the safety comes from who is let in and what they know.

In practice

At a pharmacy chain, new staff sign a confidentiality agreement and take a short course on handling customer data in their first week, and their access ends on their last day.

Why it matters

Many attacks and mistakes start with a person, so controls aimed only at machines leave the most common way in wide open.

Technical control

Controls & technical basics

A safeguard built into hardware or software, which works automatically once it is set up.

Formal

A security control carried out by technology rather than by people or written rules - for example encryption, MFA, a firewall, backups or logging - one of the four control themes in ISO 27002.

In plain English

Like the automatic lock on a car that clicks shut when you walk away - it protects you whether or not you remember.

In practice

At a Danish university, the IT department no longer just asks staff not to plug in unknown USB sticks; it blocks them on every staff laptop through one central setting.

Why it matters

Machines apply a rule the same way every time, but a technical control set up wrongly gives false comfort, so it still needs rules and people around it.

Shared connections

Security controlOrganisational control

Atlas is in beta.