Security Control Validation

At the Cyber Leaders’ Summit in Antwerp, I moderated a panel on what ‘doing more with less’ really means when security leaders have to decide what deserves their people, money and attention.

At the ISF Orange Chapter meeting, I shared our perspective on security control validation, a structured approach to proving whether controls work under real world conditions.

Security control validation is the foundation of knowing whether your controls are actually working in real world conditions. This article defines the concept, explores how it differs from control testing or -monitoring, and outlines a pragmatic approach to validating both technical and organizational controls.