Control Person
For control person liability under § 20(a) (and also for § 15), there must still be a primary violator.
Control person liability will then create liability to the same extent in anyone who had control over the primary violator.
Control
Control means having the power to control the general affairs of an entity at the time it violated securities law and to have the power to control or influence the policies with resulted in the liability.
After showing control, it is then the defendant's burden to prove he didn't have control. However, how it exactly works is kind of vague.