1.1 — Security Controls

Technical Control

A security control implemented through technology, such as firewalls, antivirus software, or operating system settings.

Managerial Control

A security control implemented through policies, procedures, standards, and administrative processes.

Operational Control

A security control primarily implemented by people, such as guards, training, and awareness programs.

Physical Control

A control that limits or manages physical access to buildings, rooms, systems, or devices.

Preventive Control

A control designed to stop or limit a security event before it occurs.

Deterrent Control

A control designed to discourage someone from attempting a security violation.

Detective Control

A control designed to identify, warn about, or record a security event after or while it occurs.

Corrective Control

A control used after an event is detected to reverse, limit, or recover from its effects.

Compensating Control

An alternative control used when the preferred security control cannot currently be implemented.

Directive Control

A control that directs users toward a desired security behavior.

Firewall Rule

A technical preventive control that can block unauthorized access to a network resource.

Onboarding Policy

A managerial preventive control that establishes security requirements for new employees.

Guard Shack

An operational preventive control where personnel check identification before allowing access.

Door Lock

A physical preventive control that blocks physical access to a room or facility.

Security Splash Screen

A technical deterrent that warns unauthorized users and discourages improper access.

Demotion or Dismissal Policy

A managerial deterrent that discourages employees from violating security policies.

Reception Desk

An operational deterrent that provides visible personnel monitoring people entering a facility.

Warning Sign

A physical deterrent that warns individuals about restricted access or consequences.

System Logs

A technical detective control that records system activity and can reveal security events.

Login Report Review

A managerial detective activity used to identify suspicious access patterns.

Security Patrol

An operational detective control where personnel inspect an area for signs of intrusion.

Motion Detector

A physical detective control that detects movement in an area.

Backup Restoration

A technical corrective control used to return a system to a known-good state after an incident.

Security Incident Reporting Policy

A managerial corrective control that defines how security issues should be reported and escalated.

Contacting Law Enforcement

An operational corrective action used after certain physical or legal security incidents.

Fire Extinguisher

A physical corrective control used to stop a fire from causing further damage.

Firewall Rule as Temporary Protection

A compensating technical control that may block exploitation until a vulnerable application can be patched.

Separation of Duties

A managerial compensating control that divides responsibilities so one individual does not have excessive control.

Multiple Security Guards

An operational compensating control that reduces the risk of one person having unrestricted security authority.

Generator

A physical compensating control that provides temporary power during an outage.

Encrypted Storage Policy

A directive control that tells users to store sensitive information in protected encrypted storage.

Compliance Policy

A managerial directive control that explains required security procedures.

Security Training

An operational directive control that teaches users proper security behavior.

Authorized Personnel Only Sign

A physical directive control that tells people whether they should enter an area.

Control Category

Describes how or by whom a security control is implemented.

Control Type

Describes what a security control is intended to accomplish.