Control

Early in my IT career, I wouldn’t have been able to tell you what a Control was, and I can’t recall referencing a Policy or Standard to get anything done or have anyone even point me in the direction of those documents. I’m not sure they even existed for those organizations. That was over 30 years ago. But what is surprising to me is that I come across organization after organization who still have not formalized their security program with the appropriate items. There might be a simple security policy that references a few things that someone might have heard about in the news or read about in an article somewhere. One thing I can say for sure about them is that they are woefully incomplete.