Which option best exemplifies a general IT control?

• A. Access control and security governance that protect the IT environment.
• B. Data encryption performed within a specific application.
• C. Output routing rules within a software module.
• D. Input validation in an application.

Answer: (A)

General IT controls are the overarching safeguards that apply to the IT environment as a whole, ensuring systems are secure, reliable, and aligned with policies. Access control and security governance protect the entire IT landscape by defining who may access what, enforcing roles and approvals, and providing ongoing oversight. This broad, environment-wide protection establishes the foundation that allows individual applications and processes to operate safely, which is why it’s the best example of a general IT control. In contrast, encryption within a specific application, output routing rules in a module, and input validation in an application are tied to particular systems or functions and are considered application controls rather than general IT controls.