Does your organization have IT security controls? Yes, of course. How formally those controls are documented can vary widely.