How to approach security measures and controls

A control, or a security measure, is a tool for treating risk. Controls can reduce the impact or likelihood of a risk, thus decreasing its overall rating.