A compliance control is a policy, process, or technical check used to ensure an organization follows legal, regulatory, or contractual requirements. In cybersecurity, controls can include access reviews, logging, retention rules, data handling procedures, and automated validation of customer-facing information. The goal is not only to satisfy auditors, but to reduce the chance that systems, users, or vendors create legal exposure.
Compliance controls matter because many security failures are also rule failures: missing approvals, incomplete disclosures, weak recordkeeping, or stale data can become violations even when no breach occurs. Attackers may exploit poor control environments through fraud, privilege misuse, or tampered workflows. Defenders use controls to catch those gaps early, for example by comparing approved policy to live system output, requiring evidence for each action, and flagging exceptions. In a regulated sales process, an address-availability check is a compliance control when it ensures the customer sees the full, required picture.