Types of security controls
Exam objective 1.1: Compare and contrast various types of security controls.
On this page
A control is anything that reduces risk. The exam sorts controls two ways at once: by category (who or what carries the control out: technical, managerial, operational, physical) and by type (what the control does in time: prevent, deter, detect, correct, compensate, direct). Most questions hand you one control and ask you to place it on both axes.
Two axes: category and type
Think of every control as a point on a grid. The category answers "how is this implemented?" The type answers "what job does it do relative to an incident?" A firewall rule is technical (software enforces it) and preventive (it stops traffic before harm happens). A security guard is physical-adjacent but is usually classed as operational, because a person carries it out, and is both deterrent and detective.
| Category | Carried out by | Examples |
|---|---|---|
| Technical | Hardware, software, firmware | Firewall rules, encryption, MFA, antivirus, access control lists |
| Managerial | Policy and oversight decisions | Risk assessments, security policies, vendor reviews, hiring standards |
| Operational | People following procedures | Guards, awareness training, log review, change procedures |
| Physical | Tangible barriers in the real world | Fences, locks, bollards, mantraps, lighting |
Control types by function
| Type | Job | Examples |
|---|---|---|
| Preventive | Stops an incident before it happens | Door lock, firewall deny rule, least-privilege permissions |
| Deterrent | Discourages an attacker from trying | Warning signs, visible cameras, login banners |
| Detective | Identifies an incident during or after | IDS alerts, log review, motion sensors, audits |
| Corrective | Limits damage and restores normal state | Restoring from backup, patching after exploit, reimaging |
| Compensating | Alternative when the primary control can't be used | Network isolation for a system that can't be patched |
| Directive | Tells people what to do | Policy, signage saying "authorized personnel only", procedures |
A single control often has more than one type. A camera that people can see deters; the recording detects. The exam usually wants the primary purpose described in the scenario, so read for verbs: "discourage" points to deterrent, "identify" or "alert" to detective, "restore" to corrective.
Choosing and layering controls
No single control is enough. Defense in depth stacks categories and types so a failure in one layer is caught by another: a policy (managerial, directive) requires MFA, the identity provider enforces it (technical, preventive), and the SOC reviews impossible-travel alerts (operational, detective).
- Cost should not exceed the value of what the control protects.
- Controls that frustrate users get bypassed; usability is a security property.
- Every preventive control should be paired with a way to detect when it fails.
Key terms
- Technical control
- A safeguard enforced by hardware or software, such as a firewall rule, encryption, or MFA.
- Managerial control
- A safeguard that sets direction and oversight, such as risk assessments and security policies.
- Operational control
- A safeguard carried out by people following procedures, such as guards or awareness training.
- Physical control
- A tangible barrier or device that protects facilities and hardware, such as fences, locks, or bollards.
- Preventive control
- A control that stops an incident from happening in the first place.
- Deterrent control
- A control that discourages an attacker from attempting an attack without physically stopping them.
- Detective control
- A control that identifies and records an incident while it happens or afterward.
- Corrective control
- A control that limits damage and returns a system to its normal state after an incident.
- Compensating control
- An alternative safeguard used when the primary control isn't feasible, reducing the same risk another way.
- Directive control
- A control that tells people what is expected of them, such as a policy or an instruction sign.
Check yourself
20 practice questions on this objective
Practice this objectiveFlashcards for this objective