the objective of the control category is to avoid breaches of any law, statutory, regulatory, or contractual obligations, and of any security requirements.