Is a Policy a Control?

Is a Policy a Control?

Yes. A policy is a control since a policy is merely an “administrative safeguard” and that meets the criteria of a control.

A control is a “means of managing risk, including policies, procedures, guidelines, practices or organizational structures, which can be of an administrative, technical, management, or legal nature.”