Control

Measure that maintains and/or modifies risk (3.1) Note 1 to entry: Controls include, but are not limited to, any process, policy, device, practice, or other conditions and/or actions which maintain and/or modify risk. Note 2 to entry: Controls may not always exert the intended or assumed modifying effect.