Definition
A retired control is a control that served and was stood down, with the reason recorded — most often because a review found a better answer, or because the activity or space it protected changed.
Retirement is a decision. It usually arrives through a review, and the reason is recorded on the control. Retired pieces move to the Archive: set aside from the active jigsaw, never erased. The record of what protected people, and when, stays intact — retiring loses nothing.
The word retired is reserved for that deliberate ending. A control that quietly stopped being practiced is something else: a current control whose record no longer matches reality — which is exactly what flags and reviews exist to catch.
Why This Matters
An organization’s protection changes as the organization changes. Retirement is how a living system lets go of controls that finished their work while keeping the full record of the protection that existed at every point in time — the history that defensibility is built from.