What it means
A control objective explains why protection is needed and what successful control performance should accomplish. It is broader than a specific safeguard. The objective might be to prevent unauthorized administrative access, preserve recoverable copies of critical data, or detect material changes to approved configurations.
How it works
Organizations translate requirements, risks, and business needs into objectives, then select controls that can achieve them. Evidence and metrics should test the objective, not merely prove that a tool exists. Multiple preventive, detective, corrective, and compensating controls may support one objective.
The objective 'only authorized personnel can approve payments' may be supported by identity proofing, role-based access, separation of duties, transaction limits, approval records, and monitoring for unusual activity.
Practical focus
- Write objectives as measurable outcomes rather than product names
- Trace objectives to risks, obligations, and business requirements
- Assess whether combined controls achieve the intended outcome
- Update objectives when the system, threat, or business context changes
Common mistakes
- Equating control installation with objective achievement
- Writing objectives so vaguely that they cannot be assessed
- Testing paperwork while ignoring real operating effectiveness
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: