# Control definition

URL: /systems/trust-and-governance/controls/control-definition · Id: `control:control-definition`

> Every control declares a test, at least one criterion and at least one implementer before it merges.

Every control declares a test, at least one criterion and at least one implementer before it merges.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC5.1](/systems/trust-and-governance/criteria/soc2/cc5-1) | The entity selects and develops control activities that mitigate risks to its objectives to acceptable levels. |
| [SOC2 CC5.3](/systems/trust-and-governance/criteria/soc2/cc5-3) | The entity deploys control activities through policies that set expectations and procedures that put them into action. |

## Implemented by
- [Compliance](/workflows/processes/compliance)
- [Verification](/code/verification)
- [Compliance](/systems/compliance)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every merged Change that adds or edits a control or its test. |
| Assert | Each control has a test, a criterion and an implementer, and no test was loosened without a Decision. |

## Owner
[Compliance Officer](/agents/legal/compliance-officer), [Legal Team](/agents/legal).

## Example
A [Change](/business/nouns/change) adds a control for supplier [Credentials](/business/nouns/credential) to a home-appraisal service. It merges only once it names its test, one criterion and the [Credential check](/workflows/processes/supply/credential-check) [Workflow](/business/nouns/workflow) as implementer.