Definition: A security control that is primarily implemented and executed by people and is typically supported by the use of technology, such as supporting software. (ITSG-33/HTRA)