diff --git a/cmd/neofs-node/config/control/config.go b/cmd/neofs-node/config/control/config.go
new file mode 100644
index 0000000000..e1b8766812
--- /dev/null
+++ b/cmd/neofs-node/config/control/config.go
@@ -0,0 +1,47 @@
+package controlconfig
+
+import (
+	"github.com/nspcc-dev/neofs-node/cmd/neofs-node/config"
+)
+
+// GRPCConfig is a wrapper over "grpc" config section which provides access
+// to gRPC configuration of control service.
+type GRPCConfig struct {
+	cfg *config.Config
+}
+
+const (
+	subsection     = "control"
+	grpcSubsection = "grpc"
+
+	// GRPCEndpointDefault is a default endpoint of gRPC Control service.
+	GRPCEndpointDefault = ""
+)
+
+// AuthorizedKeysString returns string array of "authorized_keys" config
+// parameter from "control" section.
+//
+// Returns empty list if not set.
+func AuthorizedKeysString(c *config.Config) []string {
+	return config.StringSliceSafe(c.Sub(subsection), "authorized_keys")
+}
+
+// GRPC returns structure that provides access to "grpc" subsection of
+// "control" section.
+func GRPC(c *config.Config) GRPCConfig {
+	return GRPCConfig{
+		c.Sub(subsection).Sub(grpcSubsection),
+	}
+}
+
+// Endpoint returns value of "endpoint" config parameter.
+//
+// Returns GRPCEndpointDefault if value is not a non-empty string.
+func (g GRPCConfig) Endpoint() string {
+	v := config.String(g.cfg, "endpoint")
+	if v != "" {
+		return v
+	}
+
+	return GRPCEndpointDefault
+}
diff --git a/cmd/neofs-node/config/control/config_test.go b/cmd/neofs-node/config/control/config_test.go
new file mode 100644
index 0000000000..7659580bab
--- /dev/null
+++ b/cmd/neofs-node/config/control/config_test.go
@@ -0,0 +1,37 @@
+package controlconfig_test
+
+import (
+	"testing"
+
+	"github.com/nspcc-dev/neofs-node/cmd/neofs-node/config"
+	controlconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/control"
+	configtest "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestControlSection(t *testing.T) {
+	t.Run("defaults", func(t *testing.T) {
+		empty := configtest.EmptyConfig()
+
+		require.Empty(t, controlconfig.AuthorizedKeysString(empty))
+		require.Equal(t, controlconfig.GRPCEndpointDefault, controlconfig.GRPC(empty).Endpoint())
+	})
+
+	const path = "../../../../config/example/node"
+
+	var keys = []string{
+		"035839e45d472a3b7769a2a1bd7d54c4ccd4943c3b40f547870e83a8fcbfb3ce11",
+		"028f42cfcb74499d7b15b35d9bff260a1c8d27de4f446a627406a382d8961486d6",
+	}
+
+	var fileConfigTest = func(c *config.Config) {
+		require.Equal(t, keys, controlconfig.AuthorizedKeysString(c))
+		require.Equal(t, "127.0.0.1:8090", controlconfig.GRPC(c).Endpoint())
+	}
+
+	configtest.ForEachFileType(path, fileConfigTest)
+
+	t.Run("ENV", func(t *testing.T) {
+		configtest.ForEnvFileType(path, fileConfigTest)
+	})
+}
diff --git a/config/example/node.env b/config/example/node.env
index fe40a28b05..61688a7606 100644
--- a/config/example/node.env
+++ b/config/example/node.env
@@ -19,6 +19,10 @@ NEOFS_GRPC_TLS_ENABLED=true
 NEOFS_GRPC_TLS_CERTIFICATE=/path/to/cert
 NEOFS_GRPC_TLS_KEY=/path/to/key
 
+# Control service section
+NEOFS_CONTROL_AUTHORIZED_KEYS=035839e45d472a3b7769a2a1bd7d54c4ccd4943c3b40f547870e83a8fcbfb3ce11 028f42cfcb74499d7b15b35d9bff260a1c8d27de4f446a627406a382d8961486d6
+NEOFS_CONTROL_GRPC_ENDPOINT=127.0.0.1:8090
+
 # Contracts section
 NEOFS_CONTRACTS_BALANCE=5263abba1abedbf79bb57f3e40b50b4425d2d6cd
 NEOFS_CONTRACTS_CONTAINER=5d084790d7aa36cea7b53fe897380dab11d2cd3c
diff --git a/config/example/node.json b/config/example/node.json
index 5d2a97fac1..f651595028 100644
--- a/config/example/node.json
+++ b/config/example/node.json
@@ -25,6 +25,15 @@
       "key": "/path/to/key"
     }
   },
+  "control": {
+    "authorized_keys": [
+      "035839e45d472a3b7769a2a1bd7d54c4ccd4943c3b40f547870e83a8fcbfb3ce11",
+      "028f42cfcb74499d7b15b35d9bff260a1c8d27de4f446a627406a382d8961486d6"
+    ],
+    "grpc": {
+      "endpoint": "127.0.0.1:8090"
+    }
+  },
   "contracts": {
     "balance": "5263abba1abedbf79bb57f3e40b50b4425d2d6cd",
     "container": "5d084790d7aa36cea7b53fe897380dab11d2cd3c",
diff --git a/config/example/node.yaml b/config/example/node.yaml
index ccf1fd274e..3fd0a7ef53 100644
--- a/config/example/node.yaml
+++ b/config/example/node.yaml
@@ -23,6 +23,13 @@ grpc:
     certificate: /path/to/cert
     key: /path/to/key
 
+control:
+  authorized_keys:
+    - 035839e45d472a3b7769a2a1bd7d54c4ccd4943c3b40f547870e83a8fcbfb3ce11
+    - 028f42cfcb74499d7b15b35d9bff260a1c8d27de4f446a627406a382d8961486d6
+  grpc:
+    endpoint: 127.0.0.1:8090
+
 contracts:
   balance: 5263abba1abedbf79bb57f3e40b50b4425d2d6cd
   container: 5d084790d7aa36cea7b53fe897380dab11d2cd3c