Articles
Organisational, technical and physical controls: three families of control
How NIST sorts controls by who executes them, and where physical controls sit.
Assurance
Directly assigned
Articles
Designed, implemented, verified: three different claims about a control
Designed, implemented and effective: three different claims, each with its own evidence.
Articles
Evidence and audit trails: how a control becomes provable
An audit trail records what happened; evidence is the proof a control works.