Key Control
What is Key Control?
A critical control that directly addresses a significant risk and whose failure would materially increase the likelihood or impact of that risk.
Terms that appear alongside key control
Each of these is named in at least one of the same controls as key control. The number is how many controls name both.
- risk analysis 2 shared controls
- risk committee 2 shared controls
- control effectiveness 2 shared controls
- audit committee 2 shared controls
- iso 31000 2 shared controls
- heat map 2 shared controls
- risk matrix 2 shared controls
- emerging risk 2 shared controls
Frameworks that govern key control
What the standards actually require on key control
Requirements naming key control across 6 standards, quoted from the control text.
Sensitive data has data quality measurement switched on, and metrics are shared as soon as they exist so owners and consumers can judge fitness for purpose. Automation opportunities: deliver quality metrics automatically to owners and consumers;
edm-council-cdmc-cloud-data-management-capability-framework::KC12 · Key Control 12: Data Quality Measurement →The institution regularly tests or otherwise monitors the effectiveness of the safeguards' key controls, systems and procedures, including those that detect actual and attempted attacks on, or intrusions into, information systems.
ftc-glba-safeguards-rule-16-cfr-part-314::314.4(d)(1) · 314.4(d)(1) Regular testing or monitoring of key controls →The Licensee puts information safeguards in place to handle the threats that its continuing assessment identifies, and at least once a year it assesses how effective the key controls, systems and procedures of those safeguards are.
naic-insurance-data-security-model-law-mdl-668::4C(5) · Implement safeguards and assess key controls at least annually →Describe ongoing and separate evaluations of key control activities and other internal control components related to cybersecurity: the mix used (continuous and periodic internal audit, penetration testing, independent certification against security specificat...
soc-for-cybersecurity-cybersecurity-risk-management-examination::DC15 · DC15 Process for ongoing and periodic evaluations of key control effectiveness →Enhanced: establish and document key control procedures for issuing, tracking, collecting, reporting loss of and preventing unauthorized duplication of keys; use patent keys to prevent duplication; conduct key inventories every 24 months.
tsa-pipeline-security::T2.04 · Table 2 Locks and key control →Business process activities and their related controls are assessed and monitored continually according to enterprise risk so that processing controls match what the business needs: the control activities that key processes require to meet control requirements...
cobit-2019::DSS06.01 · DSS06.01 Align control activities embedded in business processes with enterprise objectives →Questions people ask about key control
What is Key Control?
Why is Key Control important for compliance?
Which compliance frameworks address Key Control?
Where can I learn more about Key Control?
See how Key Control applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.