Control Objective
A statement describing what a specific control or group of controls is intended to achieve. Control objectives bridge the gap between high-level policies and the specific technical or procedural controls that implement them.
Why it matters
Controls without objectives are activities without purpose. You know what you are doing but not why. Control objectives make the intent explicit, which serves three functions: they guide control design so implementers know what outcome to target, they provide auditors with criteria to assess effectiveness, and they help leadership understand what each control contributes to the overall security posture without needing to understand technical details.
In practice
Control objectives typically come from frameworks (ISO 27001 Annex A objectives, SOC 2 Trust Services Criteria) or from internal policy requirements. Each objective may be satisfied by one or multiple controls. In vucavoid, controls are linked to the requirements they fulfill, and requirements carry the objective context from their source framework. This linkage makes it clear why each control exists and what gap it would leave if removed.