Chain of control is the sequence of people, systems, approvals, and actions that determines who can govern a process and who can verify that it happened correctly. It is closely related to accountability and trust: if you can trace each step back to an authorized owner, you can decide whether the activity was legitimate, who approved it, and where responsibility ends.
In cyber security, chain of control matters whenever identity, authorization, or evidence is disputed. Attackers try to break it through spoofing, impersonation, compromised suppliers, or unauthorized automation, so the visible sender or brand is not the real actor. Defenders use logs, access controls, signatures, change approvals, and vendor oversight to preserve a verifiable chain. A strong chain of control helps investigators attribute actions, helps auditors confirm compliance, and helps organizations prove which parts of a process were actually under their control.