Which activity involves proving that an existing control is the correct control?

• A. Validate a Control
• B. Verify a Control
• C. Implement a Control
• D. Monitor a Control

Answer: (A)

The main idea is to determine whether a control is the right remedy for the identified risk in the given environment. Validating a control means confirming its suitability and effectiveness in real-world conditions — that the control actually addresses the risk as intended, fits the organizational context, and achieves the desired level of risk reduction. It involves assessing whether the control’s design and implementation make sense for the specific threat landscape, regulatory requirements, and operational constraints, and gathering evidence (testing results, audits, scenario analyses) to support that it is the correct choice.

Verifying a control would focus more on whether the control is correctly designed or implemented according to specifications, rather than proving it is the right control for the risk. Implementing a control is about deploying it, and monitoring a control is the ongoing observation of its performance over time.