{"id":65927,"date":"2023-08-23T09:49:31","date_gmt":"2023-08-23T13:49:31","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=65927"},"modified":"2024-08-15T16:34:46","modified_gmt":"2024-08-15T20:34:46","slug":"what-are-it-general-controls-itgc","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc","title":{"rendered":"What Are IT General Controls (ITGC)?"},"content":{"rendered":"\n<p>Whether employees know it or not, IT has a tremendous effect on their everyday working lives.<\/p>\n\n\n\n<p>IT is essentially the lifeblood of a company, ensuring employees\u2019 laptops work, procuring and installing the applications employees need to do their jobs, and instituting and upholding rules to help the company <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-it-compliance\">stay compliant<\/a>.<\/p>\n\n\n\n<p>But how does the IT team accomplish those tasks in a standardized, secure way?<\/p>\n\n\n\n<p>The answer lies in IT general controls. IT general controls, or ITGCs, are a set of directives that govern how an organization\u2019s systems operate. Yet, knowing what ITGCs are and how they work in practice isn\u2019t always straightforward.<\/p>\n\n\n\n<p>In this post, we\u2019ll explain what ITGCs are, share examples of how they work in practice, and review the compliance frameworks that serve as their foundation.<\/p>\n\n\n\n<figure class=\"image is-16by9\">\n<iframe class=\"has-ratio\" width=\"300\" height=\"315\" src=\"https:\/\/www.youtube.com\/embed\/8TseSrOt5Ro?rel=0\" frameborder=\"0\" allow=\"accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen=\"\"><\/iframe>\n<\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-definition-of-it-general-controls-itgc\">Definition of IT General Controls (ITGC)<\/h2>\n\n\n\n<p>ITGC, or IT general controls, are a set of policies and procedures that <a href=\"https:\/\/jumpcloud.com\/blog\/it-governance-vs-compliance\">govern how a company\u2019s IT systems operate<\/a> and ensure the confidentiality, integrity, and availability of data.<\/p>\n\n\n\n<p>These controls help prevent unauthorized access, data breaches, and operational disruptions. ITGC covers every aspect of IT, including software implementation, user account creation, and data management. Effective ITGC can improve the reliability and accuracy of financial reporting and reduce the risk of fraud. Companies are required to establish and maintain ITGC to comply with various regulatory requirements such as SOX, HIPAA, and PCI DSS.<\/p>\n\n\n\n<p>One important thing to note is that Information Technology General Controls are not the same as application controls. ITGCs govern the use of all systems within a company, from ERPs to servers, directory platforms, and project management tools. Application controls restrict what users can do within one particular platform, and typically these permissions are configured directly within that application and pertain to specific features or use cases.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-importance-of-itgc-in-organizations\">Importance of ITGC in Organizations<\/h2>\n\n\n\n<p>IT general controls are non-negotiable for companies that access, store, and leverage consumer data \u2014 particularly sensitive information, such as healthcare, financial, and personal records.<\/p>\n\n\n\n<p>Without ITGC, companies are at a high risk of cybersecurity attacks and regulatory noncompliance, jeopardizing their ability to build trust with customers and sustain regular business operations. Proper ITGC implementation reduces the chances of an internal or external breach and noncompliance, protecting your organization\u2019s reputation and safeguarding your customers\u2019 information.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-examples-and-key-components-of-itgc\">Examples and Key Components of ITGC<\/h2>\n\n\n\n<p>ITGCs can take on many forms, but most fall under a few distinct categories. Let\u2019s review each in detail.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-access-controls\">Access Controls<\/h3>\n\n\n\n<p>ITGCs should include various methods of preventing unauthorized access and data manipulation. Coupling <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-password-management\">robust password management<\/a> with a <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-least-privilege\">least-privilege access<\/a> policy can instantly lower the chances of a cyberattack. <a href=\"https:\/\/jumpcloud.com\/blog\/fde-compliance\">Full disk encryption<\/a> is also a common access-related ITGC because it completely locks devices, even while at rest. So if a device is stolen, the hard drive cannot be accessed without the proper recovery key. Access-related ITGCs may also entail quarterly or annual inventory audits to pinpoint the most valuable data and reevaluate the controls designed to protect it.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-change-management\">Change Management<\/h3>\n\n\n\n<p>IT environments are always changing; new applications are added, others are removed, and some are updated to the newest release. Change management controls help companies document and authorize changes and perform a root cause analysis if something goes wrong. Most regulatory bodies dedicate an entire section of their audit to the effectiveness of your change management processes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-data-backup-and-recovery\">Data Backup and Recovery<\/h3>\n\n\n\n<p>Accidents, natural disasters, or cyberattacks can happen anytime, and without backup or recovery plans in place, companies can lose significant data. Most companies enact ITGCs to minimize data loss through database segregation, automated backups, and business continuity plans. ITGCs may also incorporate regular testing of these configurations and plans to confirm their effectiveness and make adjustments as needed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-security-management\">Security Management<\/h3>\n\n\n\n<p>When we think of hackers, we often think of a person behind a computer, but that\u2019s not always the case. Unfortunately, people with ill-intent enter an office to wreak havoc, so it\u2019s important to define and consistently test physical security controls, like key badge entry to sensitive areas and intrusion detection systems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-it-operation-controls\">IT Operation Controls<\/h3>\n\n\n\n<p>General IT controls may refer to how IT systems are managed, who oversees those systems, where the IT roadmap is going, how and when to conduct risk assessments, and what best practices IT projects should follow.&nbsp;<\/p>\n\n\n\n<p>ITGCs in this group may also refer to overall security measures like email filtering, firewalls, antivirus software, and routine pen testing. In this age of remote work, general IT administration may apply to <a href=\"https:\/\/jumpcloud.com\/blog\/defining-byod-cope-cobo-cyod\">corporate-owned device (COD)<\/a> and <a href=\"https:\/\/jumpcloud.com\/blog\/how-to-create-a-byod-policy\">bring your own device (BYOD) policies<\/a> as well.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-implementation-of-itgc\">Implementation of ITGC<\/h2>\n\n\n\n<p>Implementing multiple ITGCs at once can feel overwhelming. Breaking them down into more manageable pieces makes the process easier and decreases the chances of misconfiguration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-planning-and-scoping\">Planning and Scoping<\/h3>\n\n\n\n<p>First, you need to decide what types of IT general controls you want and need to implement. Consider what type of industry you\u2019re in, what types of data you collect, store, and use, and where your customers are located.<\/p>\n\n\n\n<p>Once you\u2019ve narrowed down which ITGCs you want to achieve, estimate how long it will take to implement them. If you have a targeted end date, work backward to create a reasonable timeline for implementation, given the number of resources on your IT team, the existing tasks on their plate, and\/or the bandwidth of your <a href=\"https:\/\/jumpcloud.com\/msp\" target=\"_blank\" rel=\"noreferrer noopener\">managed service provider (MSP)<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-risk-assessment\">Risk Assessment<\/h3>\n\n\n\n<p>Next, establish a baseline for each control. That involves an in-depth review of your current IT processes and tools to understand the controls you are already managing well and any additional security measures you may need to incorporate into your plan. Prioritize these new additions based on importance and inclusion in any upcoming audits you may need to pass.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-control-design-and-implementation\">Control Design and Implementation<\/h3>\n\n\n\n<p>Now that you know <em>what<\/em> controls you need, it\u2019s time to start thinking about <em>how<\/em> to put those controls into practice. Controls can be proactive or reactive, and as their names suggest, proactive controls attempt to prevent adverse events or impacts, while reactive controls are corrective mechanisms when something goes wrong. Using proactive and reactive controls for each key area of your security program can help you cover your bases.<\/p>\n\n\n\n<p>While some ITGC are fairly universal and straightforward, some organizations may have more complex requirements based on the type of product they sell or services they offer. Working with an experienced auditing firm can help you design and customize the proper controls for your company.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-control-testing\">Control Testing<\/h3>\n\n\n\n<p>Testing is critical. Be sure to <a href=\"https:\/\/jumpcloud.com\/blog\/setting-up-jumpcloud-free\">thoroughly test each and every ITGC<\/a> to verify that it accomplishes what it was designed to do. It\u2019s a good idea to have several people test the same ITGC with different profiles to identify any abnormalities in how the control functions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-ongoing-monitoring\">Ongoing Monitoring<\/h3>\n\n\n\n<p>ITGC is not a one-and-done exercise. Be sure you have a process in place for continuously monitoring the controls you\u2019ve implemented and fix any bugs or gaps as quickly as possible.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-itgc-compliance-frameworks\">ITGC Compliance Frameworks<\/h2>\n\n\n\n<p>ITGC is a subsection of the larger IT controls space. To guarantee the highest level of compliance, companies lean on three overarching security frameworks to inform their ITGCs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-coso\">COSO<\/h3>\n\n\n\n<p>The <a href=\"https:\/\/www.coso.org\/\">Committee of Sponsoring Organizations (COSO)<\/a> framework integrates controls into everyday business processes that validate ethical and transparent operations. COSO has five requirements:<\/p>\n\n\n\n<ol>\n<li>Control environments to uphold industry-standard practices and reduce organizations\u2019 legal exposure.<\/li>\n\n\n\n<li>Control activities to make sure tasks are carried out in a way that minimizes risk and accomplishes business objectives.<\/li>\n\n\n\n<li>Information and communications that help stakeholders understand and comply with legal requirements, such as privacy regulations.<\/li>\n\n\n\n<li>Monitoring by internal and\/or external auditors to ensure employees are following existing controls.<\/li>\n\n\n\n<li>Risk assessment and management to identify and mitigate as many risks as possible.<\/li>\n<\/ol>\n\n\n\n<p>While these components are fairly vague, COSO has published detailed requirements for ESG, AI, and cloud computing-focused companies to observe corresponding regulations in those fields.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-cobit\">COBIT<\/h3>\n\n\n\n<p>The IT Governance Institute established the <a href=\"https:\/\/www.isaca.org\/resources\/cobit\">Control Objectives for Information Technology (COBIT)<\/a> framework to outline recommended ITGC objectives and approaches. The basic premise behind COBIT is that IT processes should satisfy specific business requirements to streamline operations and safeguard enterprise data. The five key COBIT principles are:<\/p>\n\n\n\n<ol>\n<li>Meeting stakeholder needs.<\/li>\n\n\n\n<li>Covering the enterprise end to end.<\/li>\n\n\n\n<li>Applying a single integrated framework.<\/li>\n\n\n\n<li>Enabling a holistic approach.<\/li>\n\n\n\n<li>Separating governance from management.&nbsp;<\/li>\n<\/ol>\n\n\n\n<p>In the United States, the <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-cobit-control-objectives-information-technology\">COBIT framework<\/a> is used to achieve compliance with the Sarbanes-Oxley Act (SOX).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso\">ISO<\/h3>\n\n\n\n<p><a href=\"https:\/\/www.iso.org\/standard\/27001\">ISO 27001<\/a> is a framework related to information security and change management. More specifically, ISO 27001 sets out policies and procedures to lessen the legal, physical, and technical risks associated with implementing, monitoring, reviewing, maintaining, and improving an information security management system. ISO 27001 uses a top-down approach, with six steps to attain compliance:<\/p>\n\n\n\n<ol>\n<li>Define a security policy.<\/li>\n\n\n\n<li>Define the scope of the information security management system.<\/li>\n\n\n\n<li>Conduct a risk assessment.<\/li>\n\n\n\n<li>Manage identified risks.<\/li>\n\n\n\n<li>Select control objectives and controls to be implemented.<\/li>\n\n\n\n<li>Prepare a statement of applicability.<\/li>\n<\/ol>\n\n\n\n<p>By <a href=\"https:\/\/jumpcloud.com\/blog\/staying-iso-compliant-remote-workers\">following ISO 27001 conditions<\/a>, companies show customers that they take security seriously and conform to industry standards.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-nist-cybersecurity-framework-csf-2-0\">NIST Cybersecurity Framework (CSF) 2.0<\/h3>\n\n\n\n<p>NIST Cybersecurity Framework (CSF) 2.0 is a comprehensive set of guidelines developed by the National Institute of Standards and Technology (NIST) to help organizations manage cybersecurity risks. It provides a structured approach for identifying, assessing, and mitigating threats to critical assets, systems, and data. It contains guidance for managing cybersecurity risks across organizations, regardless of their size, sector, or maturity. CSF would benefit small and medium-sized enterprises (SMEs) by enhancing security posture, reducing risks to operations, and promoting customer trust.<\/p>\n\n\n\n<p>The <a href=\"https:\/\/jumpcloud.com\/blog\/nist-compliance-standards\">five pillars of CSF<\/a> are:<\/p>\n\n\n\n<ol>\n<li><strong>Identity:<\/strong> To develop an understanding of cybersecurity risks, including assets, business context, and any legal requirements that may apply.<\/li>\n\n\n\n<li><strong>Protect:<\/strong> To implement safeguards\/controls to ensure critical infrastructure services are delivered securely. This includes IAM and data security.<\/li>\n\n\n\n<li><strong>Detect:<\/strong> To establish mechanisms to identify and respond to cybersecurity events promptly. Detecting threats early helps limit their impact.<\/li>\n\n\n\n<li><strong>Respond:<\/strong> To develop and execute response plans when incidents occur. This function focuses on minimizing damage and restoring normal operations.<\/li>\n\n\n\n<li><strong>Recover:<\/strong> To restore systems and services after a cybersecurity incident. Recovery efforts aim to return to normalcy while learning from the experience.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-security-concerns-with-itgc\">Security Concerns with ITGC<\/h2>\n\n\n\n<p>IT general controls lessen a company\u2019s exposure to threats and potential compliance violations that can have devastating consequences on operations, reputation, and revenue.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-insider-threats\">Insider Threats<\/h3>\n\n\n\n<p>Employees, partners, vendors, interns, and contractors can all be weak links in your company\u2019s security. They may unwittingly fall for a social engineering attack or accidentally share classified information. Some may even intentionally create a user account without proper permissions to access confidential files or steal company IP to get ahead in a new role elsewhere. ITGCs that limit and monitor data movement can prevent malicious \u2014 and unintentional \u2014 insider threats.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-external-threats\">External Threats<\/h3>\n\n\n\n<p>The <a href=\"https:\/\/jumpcloud.com\/blog\/top-data-breaches-2023\">volume of cyberattacks isn\u2019t showing signs of slowing<\/a>. Hackers are constantly brainstorming new ways to access company data, whether it be through vulnerabilities in business applications, <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-lateral-movement\">lateral movement<\/a>, spreading ransomware, taking advantage of poor password management, or employee manipulation. Monitoring audit logs, installing antivirus software, and automatically installing updates are all <a href=\"https:\/\/jumpcloud.com\/blog\/hackers-know-breach-detection-gap\">ways to thwart external threats<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-compliance-with-regulations\">Compliance with Regulations<\/h3>\n\n\n\n<p>Most modern businesses must comply with at least one federal or global regulation. ITGC helps companies adhere to those rules and maintain compliance over time, avoiding hefty penalties that can result from noncompliance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-security-concerns-with-itgc-0\">Security Concerns with ITGC<\/h2>\n\n\n\n<p>IT general controls lessen a company\u2019s exposure to threats and potential compliance violations that can have devastating consequences on operations, reputation, and revenue.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-insider-threats-0\">Insider Threats<\/h3>\n\n\n\n<p>Employees, partners, vendors, interns, and contractors can all be weak links in your company\u2019s security. They may unwittingly fall for a social engineering attack or accidentally share classified information. Some may even intentionally create a user account without proper permissions to access confidential files or steal company IP to get ahead in a new role elsewhere. ITGCs that limit and monitor data movement can prevent malicious \u2014 and unintentional \u2014 insider threats.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-external-threats-0\">External Threats<\/h3>\n\n\n\n<p>The <a href=\"https:\/\/jumpcloud.com\/blog\/top-5-security-breaches-of-2021\">volume of cyberattacks isn\u2019t showing signs of slowing<\/a>. Hackers are constantly brainstorming new ways to access company data, whether it be through vulnerabilities in business applications, <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-lateral-movement\">lateral movement<\/a>, spreading ransomware, taking advantage of poor password management, or employee manipulation. Monitoring audit logs, installing antivirus software, and automatically installing updates are all <a href=\"https:\/\/jumpcloud.com\/blog\/hackers-know-breach-detection-gap\">ways to thwart external threats<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-compliance-with-regulations-0\">Compliance with Regulations<\/h3>\n\n\n\n<p>Most modern businesses must comply with at least one federal or global regulation. ITGC helps companies adhere to those rules and maintain compliance over time, avoiding hefty penalties that can result from noncompliance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-benefits-of-itgc\">Benefits of ITGC<\/h2>\n\n\n\n<p>IT general controls give companies more than peace of mind. Let\u2019s take a look at several concrete ways ITGC benefits an organization.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-improved-security\">Improved Security<\/h3>\n\n\n\n<p>Security is one of the main purposes of instituting IT general controls. Observing security frameworks will force your organization team to adopt <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-iam\">identity and access management (IAM)<\/a> based on <a href=\"https:\/\/jumpcloud.com\/resources\/zero-trust-security\" target=\"_blank\" rel=\"noreferrer noopener\">Zero Trust security principles<\/a>, robust monitoring, encryption, and antimalware \u2014 all of which keep your data and your client\u2019s data safe.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-better-risk-management\">Better Risk Management<\/h3>\n\n\n\n<p>ITGC inherently mitigates the risk of insider and external threats by locking down end points like laptops, kiosks, and mobile devices, eliminating vulnerabilities in the applications people use every day, maintaining IAM best practices, and educating employees on the signs of a possible cyberattack.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-increased-compliance-with-regulations\">Increased Compliance with Regulations<\/h3>\n\n\n\n<p>By leveraging frameworks like COSO, COBIT, and ISO 27001, companies can adequately prepare for an initial security and compliance audit. Perhaps more importantly, routinely reviewing and amending IT policies and best practices helps companies uphold industry mandates and standards over time.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-enhanced-business-continuity\">Enhanced Business Continuity<\/h3>\n\n\n\n<p>During a security breach, everyday business tasks screech to a halt. In the days it takes companies to get the organization back up and running, they can lose hundreds of thousands of dollars in sales and productivity. Having ITGC in place reduces a company\u2019s exposure to vulnerabilities, leaks, and other cyber threats that can interrupt business activity and hurt profitability.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-best-practices-for-itgc-security\">Best Practices for ITGC Security<\/h2>\n\n\n\n<p>Bolstering organizational security should be at the top of IT teams\u2019 priority lists. Here are a few best practices to consider:<\/p>\n\n\n\n<ul>\n<li><strong>Employee training:<\/strong> Cyberattackers know that one misinformed employee can be the key to organization access and specifically design campaigns to get them to give up information. Making employees aware of cyber threats with <a href=\"https:\/\/jumpcloud.com\/resources\/security-training-employee-education-essentials\" target=\"_blank\" rel=\"noreferrer noopener\">regular security training<\/a>, regularly testing their knowledge, and notifying them of new <a href=\"https:\/\/jumpcloud.com\/blog\/phishing-attack-statistics\">phishing<\/a> or social engineering techniques can decrease the chances of a full-blown attack.<\/li>\n<\/ul>\n\n\n\n<ul>\n<li><strong>Implementing key security frameworks:<\/strong> Following COSO, COBIT, and ISO 27001 principles align your company\u2019s practices with globally defined security standards, helping you prepare for compliance audits, certifications, and other necessary requirements for enterprise and government work.<\/li>\n<\/ul>\n\n\n\n<ul>\n<li><strong>Making continuous updates: <\/strong>There\u2019s a reason why applications, systems, and networks have updates \u4e00 releases contain new features or patch existing vulnerabilities. When users don\u2019t regularly update their programs, they do themselves a disservice and put their companies at risk of an attack. That\u2019s why many ITGCs force regular updates and consistently monitor their organization\u2019s applications, systems, and network service-level commitments.<\/li>\n<\/ul>\n\n\n\n<ul>\n<li><strong>Weaving ITGC into procurement: <\/strong>Ask vendors to supply a Service Organization Controls (SOC) report and assess whether extra controls are required to keep data safe and secure. It\u2019s also a good idea to implement <a href=\"https:\/\/jumpcloud.com\/platform\/patch-management\" target=\"_blank\" rel=\"noreferrer noopener\">patch management tools<\/a> that <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-patch-management\">automatically deploy patches<\/a> to operating systems, browsers, and applications that are behind schedule.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-jumpcloud-can-strengthen-your-it-general-controls\">How JumpCloud Can Strengthen Your IT General Controls<\/h2>\n\n\n\n<p>ITGCs are essential for any business, but especially for enterprise organizations. Without ITGCs, companies of all sizes struggle with compliance, operational, and security issues. Not only do these problems drain IT departments of their time and energy, they also put businesses\u2019 reputations at risk. Enacting ITGCs keeps everyone on track, forcing them to uphold and work from a single source of truth while protecting an organization\u2019s invaluable data.<\/p>\n\n\n\n<p>But developing and sustaining them is easier said than done. Fortunately, JumpCloud\u2019s capabilities make IT control management a breeze. Working from a \u201ctrust nothing, verify everything\u201d principle, <a href=\"https:\/\/jumpcloud.com\/solutions\/zero-trust\" target=\"_blank\" rel=\"noreferrer noopener\">JumpCloud\u2019s Zero Trust security model<\/a> allows IT teams to oversee user access to applications, files, networks, devices, and more, all from an open directory platform. JumpCloud is easy to implement, works with existing multi-factor authentication (MFA) protocols companies may already have, and helps meet SOC, HIPAA, GDPR, and PCI compliance requirements.<\/p>\n\n\n\n<p>Learn more about <a href=\"https:\/\/jumpcloud.com\/solutions\/compliance\" target=\"_blank\" rel=\"noreferrer noopener\">JumpCloud\u2019s approach to compliance today<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn what ITGCs are, how they work, the compliance frameworks associated with them, and examples in practice.<\/p>\n","protected":false},"author":131,"featured_media":48935,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[2337,2753],"tags":[],"collection":[2775],"platform":[],"funnel_stage":[3015],"coauthors":[2568],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Definition &amp; Examples of IT General Controls (ITGC) - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn what ITGCs are, how they work, the compliance frameworks associated with them, and examples in practice.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Are IT General Controls (ITGC)?\" \/>\n<meta property=\"og:description\" content=\"Learn what ITGCs are, how they work, the compliance frameworks associated with them, and examples in practice.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-23T13:49:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-15T20:34:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"1067\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Kelsey Kinzer\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kelsey Kinzer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#article\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc\"},\"author\":{\"name\":\"Kelsey Kinzer\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/c4e9aeadd98cafbd216d3134ad10ab13\"},\"headline\":\"What Are IT General Controls (ITGC)?\",\"datePublished\":\"2023-08-23T13:49:31+00:00\",\"dateModified\":\"2024-08-15T20:34:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc\"},\"wordCount\":2720,\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png\",\"articleSection\":[\"Remote Work\",\"Unification\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc\",\"url\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc\",\"name\":\"Definition & Examples of IT General Controls (ITGC) - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png\",\"datePublished\":\"2023-08-23T13:49:31+00:00\",\"dateModified\":\"2024-08-15T20:34:46+00:00\",\"description\":\"Learn what ITGCs are, how they work, the compliance frameworks associated with them, and examples in practice.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png\",\"width\":1600,\"height\":1067,\"caption\":\"man staring at computer screen\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Are IT General Controls (ITGC)?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/c4e9aeadd98cafbd216d3134ad10ab13\",\"name\":\"Kelsey Kinzer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/08f33caaabd3e83507748fcc2d575a67\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9a16ebe214c820d6c288597039b7e89f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9a16ebe214c820d6c288597039b7e89f?s=96&d=mm&r=g\",\"caption\":\"Kelsey Kinzer\"},\"description\":\"Kelsey is a passionate storyteller and Content Writer at JumpCloud. She is particularly inspired by the people who drive innovation in B2B tech. When away from her screen, you can find her climbing mountains and (unsuccessfully) trying to quit cold brew coffee.\",\"sameAs\":[\"https:\/\/jumpcloud.com\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Definition & Examples of IT General Controls (ITGC) - JumpCloud","description":"Learn what ITGCs are, how they work, the compliance frameworks associated with them, and examples in practice.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc","og_locale":"en_US","og_type":"article","og_title":"What Are IT General Controls (ITGC)?","og_description":"Learn what ITGCs are, how they work, the compliance frameworks associated with them, and examples in practice.","og_url":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc","og_site_name":"JumpCloud","article_published_time":"2023-08-23T13:49:31+00:00","article_modified_time":"2024-08-15T20:34:46+00:00","og_image":[{"width":1600,"height":1067,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png","type":"image\/png"}],"author":"Kelsey Kinzer","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kelsey Kinzer","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#article","isPartOf":{"@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc"},"author":{"name":"Kelsey Kinzer","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/c4e9aeadd98cafbd216d3134ad10ab13"},"headline":"What Are IT General Controls (ITGC)?","datePublished":"2023-08-23T13:49:31+00:00","dateModified":"2024-08-15T20:34:46+00:00","mainEntityOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc"},"wordCount":2720,"publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png","articleSection":["Remote Work","Unification"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc","url":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc","name":"Definition & Examples of IT General Controls (ITGC) - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png","datePublished":"2023-08-23T13:49:31+00:00","dateModified":"2024-08-15T20:34:46+00:00","description":"Learn what ITGCs are, how they work, the compliance frameworks associated with them, and examples in practice.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#primaryimage","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/man-staring-computer-screen.png","width":1600,"height":1067,"caption":"man staring at computer screen"},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/blog\/what-are-it-general-controls-itgc#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"What Are IT General Controls (ITGC)?"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/c4e9aeadd98cafbd216d3134ad10ab13","name":"Kelsey Kinzer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/08f33caaabd3e83507748fcc2d575a67","url":"https:\/\/secure.gravatar.com\/avatar\/9a16ebe214c820d6c288597039b7e89f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9a16ebe214c820d6c288597039b7e89f?s=96&d=mm&r=g","caption":"Kelsey Kinzer"},"description":"Kelsey is a passionate storyteller and Content Writer at JumpCloud. She is particularly inspired by the people who drive innovation in B2B tech. When away from her screen, you can find her climbing mountains and (unsuccessfully) trying to quit cold brew coffee.","sameAs":["https:\/\/jumpcloud.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/65927"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/131"}],"replies":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/comments?post=65927"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/65927\/revisions"}],"predecessor-version":[{"id":114232,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/65927\/revisions\/114232"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media\/48935"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=65927"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/categories?post=65927"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/tags?post=65927"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/collection?post=65927"},{"taxonomy":"platform","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/platform?post=65927"},{"taxonomy":"funnel_stage","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/funnel_stage?post=65927"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=65927"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}