Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Control Types and Categories
What a control is
A control is any measure that reduces the likelihood or impact of a risk: a policy, a process, a technology or a physical barrier. Classifying controls helps the security manager check that the design is balanced, and that nothing relies on a single kind of protection.
Controls by when they act
| Function | Purpose | Example |
|---|---|---|
| Deterrent | Discourage the attempt | Policy with sanctions, warning banner, visible CCTV |
| Preventive | Stop the event happening | MFA, firewall rules, segregation of duties |
| Detective | Find it when it happens | SIEM alerts, reconciliations, access reviews |
| Corrective | Fix it and limit damage | Restore from backup, patching, incident response |
| Compensating | Substitute for a control that isn’t feasible | Supervisor review where duties can’t be separated |
Some lists also include recovery controls (restoring operations after a disaster) as a subset of corrective.
Function and type together
Controls are also grouped by type:
- Administrative (managerial): policies, procedures, training, reviews.
- Technical (logical): MFA, encryption, firewalls, monitoring tools.
- Physical: locks, guards, badges, environmental controls.
Compensating controls
When the preferred control isn’t feasible (too costly, technically impossible, or the team is too small), a compensating control reduces the same risk another way.
Example. A five-person finance team can’t separate payment creation from approval. The compensating control: the CFO reviews a system-generated report of every payment and every new supplier each week, signing off each one.
Choosing the mix
- Prefer prevention where it’s cost-effective: stopping an event is cheaper than dealing with it.
- Add detection, because prevention eventually fails.
- Plan correction, because some events will happen anyway.
- Prefer automated controls, protected by change management, over manual ones.
- Mix administrative, technical and physical controls.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| A control that stops an event happening | Preventive |
| Reconciliation or log review | Detective |
| Restoring from backup | Corrective |
| A substitute when the main control isn’t possible | Compensating |
| Why automated controls are preferred | Consistency, provided change is controlled |
In short
- By function: deterrent (discourage), preventive (stop), detective (find), corrective (fix and recover), compensating (substitute for a control that isn't feasible).
- By type: administrative (policies, procedures, training), technical or logical (systems), physical (locks, guards, environment).
- Preventive controls are usually preferred because stopping an event is cheaper than dealing with it, but prevention fails, so detection and correction are essential.
- Compensating controls reduce risk when the preferred control isn't possible; they must address the same risk.
- Automated controls are more consistent than manual ones, as long as change management protects them.
- Control objectives state what a control must achieve; the control is how.
Exam traps
- Logs nobody reviews aren't a detective control.
- Backups are corrective (recovery), not preventive.
- A compensating control must address the same risk as the control it replaces.
- Warning banners deter; they don't prevent.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Controls by when they act
Function and type together
1 / 9