In the CCM tool, a Control Specification is a measure that modifies risk and includes any process, policy, device, practice or any other actions which modify risk. This term is specifically used to denote elements that are put in place to manage and mitigate risks within an organization.