Types of Security Controls: Categories and Functions
Security controls are the safeguards you put in place to reduce risk. There are a lot of them, but they sort cleanly along two axes: how a control is implemented, and what it is meant to do. Understanding both is the difference between a checklist and a defensible program.
Security controls are the safeguards you put in place to reduce risk. There are a lot of them, but they sort cleanly along two axes: how a control is implemented, and what it is meant to do. Understanding both is the difference between a checklist and a defensible program.
A single control usually has one category and one or more functions. A camera is a physical control by category, and a detective control by function, and it can deter an attacker at the same time.
Controls by category
Categories describe how a control is implemented. There are four.
Controls by function
| Function | What it does | Example |
|---|---|---|
| Preventive | Stops an event from occurring | Firewall rules, security guards |
| Deterrent | Discourages an attacker from trying | Warning signs, lighting |
| Detective | Identifies and records an event | IDS, CCTV |
| Corrective | Mitigates damage and restores systems | Patching, restoring from backup |
| Compensating | An alternative when the primary control is not feasible | Segmenting a legacy server into a private network |
| Directive | Instructs and guides behavior | Acceptable Use Policy |
Functions describe what a control is meant to accomplish. The same category can serve different functions.
[[INSIGHT: Auditors and frameworks speak in both axes at once. When you can say a control is “technical and preventive” or “operational and detective,” you can show coverage across the full range instead of stacking three controls that all do the same job.]]
- Categories describe how a control is built: technical, managerial, operational, and physical.
- Functions describe what a control does: preventive, deterrent, detective, corrective, compensating, and directive.
- A compensating control is an alternative used when the primary control is not feasible.
- One control can have a category and several functions at once.
Frequently asked questions
What are the categories of security controls?
By how they are implemented: technical, managerial, operational, and physical.
What are the functional types of controls?
By what they do: preventive, deterrent, detective, corrective, compensating, and directive.
What is a compensating control?
An alternative measure used when the primary control is not feasible. For example, segmenting a legacy server into a private network when it cannot be patched.
Can one control be more than one type?
Yes. A control has a category (how it is built) and one or more functions (what it does). A camera is a physical, detective control that can also be a deterrent.
