Security control
A security control is a safeguard or countermeasure used to protect a system or organization and meet a defined security requirement.
A safeguard can be a process, a setting, or a physical measure
A locked equipment room, a restriction on who can download records, and a second-person approval requirement are all controls. Each addresses a particular security requirement. NIST’s definition covers confidentiality, integrity, and availability: keeping information private, trustworthy, and available when needed.
A product can provide several controls. A policy can require them. Neither tells you, on its own, which safeguards are actually in place. “We have an identity platform” is less informative than “only these roles can change recovery methods.”
Describe the responsibility as well as the safeguard
For a service-desk approval control, the description should identify which changes require approval, who may approve them, and who maintains the procedure. For a technical access control, it should identify the protected resource and the permissions enforced. Those details let someone maintain the control when systems or responsibilities change.
Controls can also depend on one another. An approval requirement is much weaker if the same person can grant themselves the approver role. Separation of duties explains that problem; security exceptions covers deliberate departures from a requirement.
Whether a control works as intended is a separate question. Security validation explains how to examine that question and what a test result can support.