control

ArchiMate 3.2 Equivalent: Requirement / Work Package / Security Control (Implementation & Security Aspect)

Represents a technical, administrative, or operational safeguard implemented to mitigate security threats, minimize risk scenarios, and satisfy governance policies.

Visual Styling

To apply custom icons, borders, or CSS styles to controls, use a Style Rule (e.g. style control where effectiveness == "High" { icon "shield-check" }).

---

Syntax

control <id> "<Display Name>" {
    description "<text>"
    owner "<team>"
    tags ["tag1", "tag2"]
    cost <amount> <unit>
    control_type "Preventive" | "Detective" | "Corrective" | "Deterrent" | "Compensating"
    control_category "Technical" | "Administrative" | "Physical" | "Identity & Access Management" | "Cryptography" | "Security Monitoring" | "Network Security" | "Application Security" | "Data Protection" | "Infrastructure Security" | "Data Security"
    framework "<framework_name>"
    implementation_status "Planned" | "In Progress" | "Implemented" | "Not Applicable" | "Partially Implemented"
    effectiveness "High" | "Medium" | "Low" | "Not Assessed"

    relationships { ... }
}

---

Properties

Property	Type	Allowed Values	Description
description	string	Free text	Technical implementation details of the control
owner	string	Free text	Security team or control custodian
tags	string[]	Array of strings	Categorization tags
cost	cost	cost 1500 month	Control implementation or licensing spend
control_type	enum	"Preventive", "Detective", "Corrective", "Deterrent", "Compensating"	Functional behavior of the control
control_category	enum	"Technical", "Administrative", "Physical", "Identity & Access Management", "Cryptography", "Security Monitoring", "Network Security", "Application Security", "Data Protection", "Infrastructure Security", "Data Security"	Architecture domain
framework	string	e.g. "NIST CSF", "CIS Controls v8", "SOC 2"	Standard framework mapping
implementation_status	enum	"Planned", "In Progress", "Implemented", "Not Applicable", "Partially Implemented"	Rollout progress
effectiveness	enum	"High", "Medium", "Low", "Not Assessed"	Audit/testing effectiveness grade

---

Allowed Relationship Verbs & Targets

Verb	ArchiMate / Security Relation	Allowed Target Entity Types
governed_by	Governance	policy, standard
mitigates	Mitigation	threat, risk_scenario
protects	Protection	system, app, component, infrastructure, data_object, process, agent, trust_boundary, actor (via auto-derived or explicit mechanism)
depends_on	Dependency	control, infrastructure, system, app, component, environment

Protection Mechanisms

When a control uses protects, the compiler automatically derives the mechanism based on control_category:

• "Cryptography" → mechanism "Encryption"
• "Identity & Access Management" → mechanism "Authentication"
• "Security Monitoring" → mechanism "Monitoring"

---

Complete Example

control ctrl_tls_enforcement "mTLS Communication Enforcement" {
    description "Enforces mutual TLS 1.3 authentication and encryption between all microservices"
    control_type "Preventive"
    control_category "Cryptography"
    framework "NIST SP 800-207 (Zero Trust)"
    implementation_status "Implemented"
    effectiveness "High"
    tags ["zero-trust", "encryption"]

    relationships {
        this mitigates threat_mitm "Mitigates man-in-the-middle packet eavesdropping"
        this protects app_payment_gateway "Protects ingress & egress traffic"
        this governed_by pol_transport_security
    }
}