Control types

Control types classify safeguards by the function they perform. Preventive controls stop an incident before it happens (locked doors, access rules). Detective controls identify incidents in progress or after the fact (log review, audits, CCTV footage). Corrective controls fix what an incident broke (patching, malware removal). Deterrent controls discourage attackers without physically stopping them (warning signs, visible cameras). Recovery controls restore operations after damage (backups, failover sites). Directive controls tell people what they must do (policies, procedures, signage).

The nuance is that type is assigned by use, not by the control itself. The same CCTV camera is deterrent when visibly mounted and detective when its footage is reviewed; a fence both deters and prevents. Controls are also classified by implementation category (administrative, technical, physical), which cuts across function: a policy is administrative and directive, a firewall is technical and preventive. When a required control cannot be implemented, a compensating control substitutes for it.

Exam relevance: if a scenario asks what a control does about an incident, map the verb: stops it, preventive; finds it, detective; fixes it, corrective; discourages it, deterrent; restores service, recovery; instructs people, directive. The classic confusable pair is deterrent versus preventive: deterrence works on the attacker’s decision and can be ignored, while prevention physically or logically blocks the action. Administrative measures such as separation of duties count as preventive even though nothing technical enforces the stop.