Types of Security Controls
Compare and contrast various types of security controls
What you will learn
- Separate a control's category (who implements it) from its function (what it does) — two independent axes, not one scale.
- Name the four categories and six functions, and place any control on both axes.
- Tell deterrent from preventive, and corrective from compensating — the pairs most often confused.
- Choose the right control for a described situation instead of memorising lists.
A security control is a measure taken to protect the confidentiality, integrity and availability of information. NIST defines it as a safeguard or countermeasure prescribed for a system or an organisation to meet defined security requirements. But the definition is not the hard part of this objective: controls are classified on two entirely independent axes, and the most common exam mistake here is answering on one axis when the question asked about the other.
Axis one: category — who implements it
| Technical | Implemented by the system itself: firewall, encryption, access control list, anti-malware. Sometimes called logical. |
|---|---|
| Managerial | Management decisions and processes: policies, risk assessments, security design reviews. Sometimes called administrative. |
| Operational | Carried out by people day to day: security awareness training, guards, change management, log review. |
| Physical | Restricts physical access: locks, fences, turnstiles, cameras, server cages. |
Axis two: function — what it does
| Preventive | Stops the event before it happens: a lock, a firewall, a technically enforced password policy. |
|---|---|
| Deterrent | Discourages the attacker from trying, by influencing their decision: a warning sign, lighting, a "monitored premises" notice. It does not stop someone who decides to proceed. |
| Detective | Finds out what has already happened: log review, an intrusion detection system, a fire alarm. |
| Corrective | Fixes the damage after the event and restores the state: restoring from backup, quarantining an infected file, patching the vulnerability. |
| Compensating | A stand-in when the intended control cannot be applied: segmenting the network around a legacy system that cannot be patched. |
| Directive | Directs the required behaviour: an acceptable use policy, a standard operating procedure, written instructions. |
How to hold both axes
Ask two separate questions about any control: who implements it (category) and what does it do (function). A camera: physical category, detective function. A sign saying "these premises are monitored": also physical category, but deterrent function. Same category, different function — because these are two axes, not one.
Real-world example: after a laptop is stolen
An employee's laptop is stolen from the office. The organisation responds with several controls, each sitting somewhere on both axes: an electronic lock on the floor door (physical/preventive), a sign at the entrance announcing surveillance (physical/deterrent), a camera recording the corridor (physical/detective), full-disk encryption on every device (technical/preventive), remote wipe once a loss is reported (technical/corrective), a policy requiring reports within an hour (managerial/directive), and quarterly device-protection training (operational/directive). Notice the first three are all the same category and three different functions.
Deterrent vs preventive
| Deterrent | Preventive | |
|---|---|---|
| What it acts on | The attacker's decision | The action itself |
| If they proceed anyway | It does not stop them | It stops them |
| Example | A "monitored premises" sign | A locked gate |
Corrective vs compensating
| Corrective | Compensating | |
|---|---|---|
| When it acts | After the event | Instead of an unavailable control, before the event |
| What it does | Restores the previous state | Covers a gap that cannot be closed directly |
| Example | Restoring from backup | Isolating a legacy system on its own segment because it cannot be patched |
One control can have more than one function
A visible camera is detective because it records, and deterrent because it can be seen. So which answer is right? Whichever the question describes. If it says "to document what happened for the investigation" it is detective; if it says "to reduce the chance of an attempt" it is deterrent. Read the stated purpose, not the device named.
A different taxonomy at NIST
Do not look for CompTIA's four categories inside NIST SP 800-53: that document organises its controls into twenty families with codes such as AC for access control and IR for incident response. Two taxonomies for two purposes — and the exam asks about CompTIA's.
What matters on the exam
- First decide which axis the question is on. "What type of control" can mean category or function, and only the context settles it.
- Awareness training is operational by category and directive by function. It is one of the most commonly misclassified controls.
- The words "alternative", "temporary", or "because the intended one is not possible" point to a compensating control.
- A written policy is directive; enforcing it technically in the system makes the enforcement preventive. The document and the enforcement are two controls, not one.
Quick check
Answer in your head first, then reveal.
A fence around the car park: what is its category and its function?Reveal the answer
Physical category. Preventive if it actually blocks entry; deterrent if it is low enough to be seen and stepped over. The height and the stated purpose decide the function.
A legacy system cannot be updated, so the organisation isolates it on its own segment. What function is that control?Reveal the answer
Compensating: the intended control (patching) is not possible, so a substitute covers the risk. Not corrective, because no event has occurred to correct.
What separates a managerial control from an operational one?Reveal the answer
Managerial is a decision or process at management level: writing the policy, assessing risk. Operational is what people carry out day to day: training, guarding, reviewing logs. The first decides; the second practises.
A company restores its servers from backup after a ransomware attack. Which function?Reveal the answer
Corrective: the event happened and the control restores the state. Taking the backups beforehand is preparation, but the act of restoring is corrective.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.