Which term describes proving the existence of a control?

• A. Implement a Control
• B. Verify a Control
• C. Monitor a Control
• D. Validate a Control

Answer: (B)

Verifying a control is about confirming that the control is actually in place in the environment and configured as intended. It answers the question, “Does this control exist here, and has it been implemented according to the design?” This is different from validation, which asks whether the control achieves its security objective; monitoring, which is ongoing oversight of the control’s operation over time; and implementing, which is the act of putting the control into place. In practice, verification might involve inspecting configuration baselines, reviewing change records, and examining system documentation to show the control exists and is correctly wired into the environment.