Study Guide
Security Controls: Categories and Functions
What a security control is, how it changes a risk, and the two separate questions used to classify one: how it is implemented and what it does.
Lesson 2.5 Threats, Vulnerabilities & Defence
“Control” is one of the most used words in security. A lock is a control, and so are a password rule, a staff training course, a camera and a written policy. This lesson is about what they have in common, and how to describe any one of them precisely.
Stage: Think
Sorting six controls
Here are six things an organisation uses to protect itself: a lock on the server-room door; a rule that staff must not share passwords; a camera in the car park; training on spotting fake emails; software that blocks dangerous email attachments; restoring files from a backup.
Think it through
Sort the six into groups, in any way that makes sense to you. What did you group them by?
- Hint 1: Did you group them by what each one is made of, or by what each one does?
- Hint 2: Is the camera more like the lock, or more like an alarm?
Show what happens
Two quite different groupings are common. One sorts by how each works: a person, a rule, a machine, a physical object. The other sorts by what each does: stops something, notices it, puts it right, tells people what to do. Both are useful, and security keeps them as two separate questions.
Think it through
Show the answer
Answer: B. No: it can record and discourage, but not stop.
A camera does not physically stop anyone. It can discourage a thief, and it can record or reveal a theft: two different jobs, neither of them stopping.
Stage: Explain
What a security control is
Three ideas come first.
- A threat is something that could cause harm, such as an attacker trying to get into an account.
- A vulnerability is a weakness the threat could use, such as an account protected only by a password.
- A risk is what you get when the two meet: the chance that the harm happens, and how bad it would be.
A security control is a safeguard or measure used to reduce risk by preventing, detecting, correcting, deterring or otherwise addressing security threats and vulnerabilities.
Think it through
Show the answer
Answer: C. No: it is much lower, but not zero.
The risk is much lower, not zero. The diagram below shows what changed and what did not.
A shorter working definition is that a control is something used to mitigate a vulnerability or a threat. That is a good starting point. The fuller version adds one important word: a control reduces risk. It normally lowers how likely the harm is, how bad it would be, or both. It does not necessarily remove the threat or the vulnerability.
An original diagram. A threat and a vulnerability combine into a risk; a control is applied; the risk that remains is lower, not gone.
- combined with
Threat
An attacker tries to sign in with a stolen password.
Vulnerability
The account relies on a password alone.
Risk
The account is likely to be taken over, and everything it can reach is exposed.
Security control applied
Multi-factor authentication (MFA)
Signing in now needs a second, different kind of proof as well as the password.
Reduced risk
A stolen password alone is no longer enough, so a takeover is much less likely. The risk is lower. It is not zero.
The attacker and the stolen password still exist, and MFA can itself be misconfigured or bypassed. The control changed how likely the harm is; it did not make the threat disappear.
Controls can work on either side of a risk. Multi-factor authentication lowers the likelihood of an account being taken over. A tested backup does nothing to stop ransomware arriving, but it lowers the impact, because the data can be restored. Risk develops likelihood and impact in full, and Treating Risk explains why the risk left after controls must still be assessed.
Stage: Explain
Two questions about every control
Your two ways of sorting the six controls have names. Any control can be described in two independent ways.
- Its category answers: how, or where, is the control implemented?
- Its functional type answers: what does the control do?
They are separate lists, and a control has an answer on each. Mixing them up is the most common mistake in this topic.
An original diagram. The first panel lists the four categories and the second the six functional types. Each example underneath is classified both ways.
Category
How is it implemented?
- Managerial: governance, oversight, policy and risk management.
- Operational: carried out mainly by people following processes.
- Technical: implemented and enforced by technology.
- Physical: protects buildings, equipment and physical access.
Functional type
What does it do?
- Preventive: stops an incident before it happens.
- Detective: discovers that something is happening or has happened.
- Corrective: puts things right afterwards.
- Directive: tells people what they are expected to do.
- Deterrent: discourages unwanted behaviour.
- Compensating: substitutes for a preferred control that cannot be used.
Every control gets an answer to both questions
Multi-factor authentication
Category Technical Function Preventive
Technology enforces it, and it stops a stolen password being enough.
CCTV
Category Physical Function Detective, deterrent or both
It protects premises. Monitoring and recordings discover incidents; a visible camera discourages them.
A security policy
Category Managerial Function Directive
It is a governance document, and it tells people what is expected of them.
A control usually has one category, decided by what mainly makes it work. It can have more than one functional type, depending on how it is used.
Stage: Predict
Categories: how a control is implemented
Think it through
Show the answer
Answer: C. The password rule written into the security policy.
The written rule. Managerial means the mechanisms of governance, such as policies and oversight. People carrying out the rule are operational, and the system enforcing it is technical.
There are four categories.
| Category | What it means | Examples |
|---|---|---|
| Managerial | Governance, oversight, policy and risk-management mechanisms. | Policies, governance, risk assessments |
| Operational | Security measures implemented primarily through people and processes. | Security awareness training, incident-response procedures |
| Technical | Security implemented or enforced through technology. | MFA, encryption, firewalls, security software |
| Physical | Controls protecting buildings, equipment and physical access. | Locks, barriers, CCTV (closed-circuit television) cameras, badge-controlled doors |
Managerial controls are often explained in terms of management and board oversight. One qualification makes that precise: the category refers to the mechanisms of governance and oversight, such as policies, risk assessments and reporting to the board. It does not mean “the managers themselves”. A manager who walks the building checking doors is carrying out an operational task.
The football-stadium analogy
An analogy helps: compare the four categories to how a football club runs its stadium.
| Category | At the stadium |
|---|---|
| Managerial | The club’s executives and management set the policies and rules. |
| Operational | Stewards and staff carry out the procedures. |
| Technical | Technology performs or enforces a function. |
| Physical | Gates, barriers, turnstiles and locked areas. |
For the technical category, think of VAR, the video assistant referee: the video system used to review refereeing decisions. That is only an analogy: VAR illustrates technology doing a job that people would otherwise do. It is not a cybersecurity control, and it should never be given as an example of one.
Choosing the category
When a control seems to fit more than one category, ask what mainly makes it work.
- A decision, rule or oversight arrangement made by those who run the organisation: managerial.
- People doing something, following a process: operational.
- A system doing something automatically: technical.
- An object or barrier in the physical world: physical.
The answer names the category: a managerial control, an operational control, a technical control or a physical control.
Check your understanding
Show the answer
Answer: B. Managerial: it is a governance rule.
Managerial. The rule is a governance decision; the encryption software that later enforces it would be a separate, technical control.
Words in a description can point the wrong way, so read for what is actually being described.
Comparison table: scroll horizontally on narrow screens.
| The control described | Tempting answer | Better answer | Why |
|---|---|---|---|
| The board approves a policy requiring MFA for all remote access. | Technical, because of “MFA” | Managerial | What is described is the policy, a governance decision. The MFA system that later enforces it is a separate, technical control. |
| Staff complete yearly training on spotting phishing emails. | Technical, because of “emails” | Operational | It works through people and a repeated process. |
| The email system automatically quarantines messages with dangerous attachments. | Operational, because it is routine | Technical | Technology does it, with nobody involved in each decision. |
| Stewards check tickets at the gate, beside the turnstiles. | Physical, because of “gate” | Operational for the stewards; physical for the turnstiles | Two controls are present. The check is people following a procedure; the turnstile is a barrier. |
The last row shows a limit of any classification. A security guard is a person following procedures who works at a physical barrier, and different sources place guards under operational or under physical. This lesson follows the stadium analogy, in which stewards are operational and turnstiles are physical. When it matters, look at what the description emphasises.
Stage: Predict
Functional types: what a control does
Think it through
Some controls stop an incident, some notice it, and some put things right. In what order around an incident do those three act?
- Hint 1: Which one has to act before anything has happened?
- Hint 2: Which one only makes sense once there is damage to repair?
Show what happens
Stopping comes before, noticing during, and putting right after. Three more functional types do not fit on a timeline at all, as the diagram shows.
There are six functional types. Three of them fit neatly on a timeline around an incident, which makes them easy to remember. The other three are not about timing.
An original memory aid. Preventive, detective and corrective controls sit on a timeline around an incident. Directive, deterrent and compensating controls are listed separately.
Before
Preventive
Stops it happening.
MFA, access controls, firewall rules, locked doors.
During · discovers
Detective
Notices it.
Intrusion detection alerts, CCTV monitoring, log monitoring.
After · fixes
Corrective
Puts it right.
Restoring from backup, removing malware, reconfiguring a compromised system.
Not on the timeline
Tells
Directive
States what people are expected to do: a policy, a procedure, a mandatory instruction.
Discourages
Deterrent
Makes someone think twice: visible CCTV, warning signs, guards, a warning banner on a monitored system.
Substitutes
Compensating
Stands in when the preferred control cannot be used, reaching a similar objective by another route.
Before, during and after
- Preventive controls act before an incident, to stop it happening. Examples: MFA, access controls, firewall rules and locked doors.
- Detective controls act during an incident or once it has started, by discovering it. Examples: alerts from an intrusion detection system (IDS), which watches network or system activity for signs of an attack; CCTV monitoring; and log monitoring.
- Corrective controls act after an incident, to fix what went wrong. Examples: restoring from backup, removing malware and reconfiguring a compromised system.
Directive, deterrent and compensating
- Directive controls tell people what they are expected to do. Memory aid: it tells you. Examples: a policy, a procedure, security instructions and mandatory requirements.
- Deterrent controls discourage unwanted behaviour. Memory aid: it makes you think twice. Examples: visible CCTV, warning signs, guards, and the banner some systems show at sign-in warning that use is monitored.
- Compensating controls are alternative safeguards used when the preferred control cannot be implemented. Memory aid: a substitute control.
Directive and deterrent are easy to confuse. A directive control addresses people who intend to follow the rules: it tells them what the rules are. A deterrent control addresses someone who is thinking of breaking them: it raises the chance of being caught or the effort needed. A “No entry: authorised staff only” sign tells people the rule. A “CCTV in operation” sign makes them think twice.
Check your understanding
Show the answer
Answer: C. Directive: it tells people what is expected.
Directive. It tells people the rule. A poster warning that unlocked screens are logged and reported would add a deterrent.
Compensating controls: a legacy system without MFA
A legacy system is an older system that is still in use and often cannot be updated to support modern security features. Suppose an organisation requires MFA on every system, and one legacy system cannot support it. The preferred control cannot be used, so the organisation needs another way to reach the same objective: making it unlikely that a stolen password leads to misuse of that system.
Think it through
The legacy system cannot have MFA. What else could make it unlikely that a stolen password leads to misuse of that system?
- Hint 1: Who and where should be able to reach the system at all?
- Hint 2: What would let someone notice misuse quickly?
Show what happens
Limit who can reach it and from where, route administrators through a closely watched computer, and watch the system more closely. Each stands in for the missing MFA by another route.
Possible compensating controls include:
- restricting access so the system can be reached only from trusted networks;
- restricting access to a small, named group of people;
- requiring a jump host: a hardened, closely monitored computer that administrators must connect to first, and from which they then reach the legacy system;
- increasing logging and monitoring of the system;
- reviewing who has access more often.
A compensating control is not simply “extra security”. Adding another camera to the car park does nothing for the missing MFA. To count as compensating, a control has to stand in for a specific control that cannot be used and provide an alternative way of achieving a similar security objective.
Stage: Check
Classifying a control both ways
A full description of a control answers both questions.
Comparison table: scroll horizontally on narrow screens.
| Control | Category | Functional type | Reasoning |
|---|---|---|---|
| MFA | Technical | Preventive | Technology enforces it; it stops a sign-in that has only a password. |
| CCTV | Physical | Detective, deterrent or both | Reviewing or monitoring footage discovers incidents; a visible camera discourages them. It does not physically stop anyone. |
| A security policy | Managerial | Directive | A governance document that tells people what is expected. |
| Intrusion detection alerts | Technical | Detective | Technology watches for signs of an attack and raises an alert; it does not stop the attack by itself. |
| Restoring data from a backup | Technical | Corrective | Backup technology puts the data back after the incident. |
| A locked server-room door | Physical | Preventive | A physical barrier that stops entry. |
Every row applies the same two questions. CCTV is commonly classed as physical, although some sources treat cameras as technical, so check which taxonomy is in use.
A college fits badge readers to the doors of its computer rooms.
- Ask what mainly makes it work. A reader and a lock on a door: something in the physical world that controls who gets in. Category: physical, as the categories table lists badge-controlled doors.
- Ask what it does. It stops anyone without a valid badge from entering. Functional type: preventive.
- Check for a second function. The readers also record which badge opened which door, and a technician reviews that record every week. Used that way, the same control is also detective.
- Write the sentence. “The badge-controlled door is a physical control: preventive, and detective when its entry record is reviewed.”
Why that answer: the two questions were answered separately, and the second function was named together with the use that gives it.
Two habits help. First, answer the questions separately: decide the category without thinking about the function, then the function without thinking about the category. Second, expect some controls to have more than one function, as CCTV does, and say which one a particular use relies on.
Check your understanding
Show the answer
Answer: B. Physical, preventive: it stops paper being read.
Physical and preventive: an object in the physical world that stops confidential paper being read by anyone who later finds it.
Stage: Explain
Administrative, managerial and management controls
You will also meet the term Administrative (Management) Controls. These terms need care, because different frameworks divide controls differently.
Administrative controls are controls based primarily on policies, procedures, governance, organisational rules, and people and processes, as opposed to technology or physical barriers. Examples include security policies, an acceptable-use policy, training, background checks, risk assessments, incident-response procedures, access reviews, segregation of duties and change-management procedures.
Three ways of dividing controls are in common use. The third comes from NIST, the United States National Institute of Standards and Technology, which publishes widely used security guidance.
| Model | Its categories | Where policies and training sit |
|---|---|---|
| A three-category model | Administrative, technical, physical | Both are administrative. |
| The four-category model used in this lesson | Managerial, operational, technical, physical | Policies are managerial; training is operational. |
| Older NIST guidance | Management, operational, technical | Policies are management; training is operational. |
So “administrative” in the three-category model covers most of what the four-category model splits between managerial and operational. “Managerial” and “management” are used for the governance and oversight part. The words overlap, but they are not always defined identically, and no single list is used everywhere.
The practical rule is to check which model a document or question is using before answering. If the choices are administrative, technical and physical, a training course is administrative. If the choices are managerial, operational, technical and physical, the same training course is operational. In either model, the reliable first step is the same: separate controls that work through policy and process from controls that work through technology and controls that work through physical barriers.
Stage: Explain
How this fits with defence in depth
Defence in Depth described four functions: preventative, detective, responsive and recovery. This lesson’s list is a different vocabulary for the same job.
| Defence in Depth | This lesson |
|---|---|
| Preventative | Preventive. The two spellings mean the same thing. |
| Detective | Detective. |
| Responsive and recovery | Corrective covers both limiting the harm and restoring normal operation. |
| Not listed | Directive, deterrent and compensating. |
Neither list is more “correct”. What matters is being able to say what a control does, and noticing when a set of controls is all of one type. An organisation with many preventive controls and nothing detective will not know when prevention has failed.
When you meet a control at work, describe it in one sentence using both questions: “The door badge reader is a physical, preventive control”, “The acceptable-use policy is a managerial, directive control”. If the sentence is hard to write, the control’s purpose is probably not clear, and that is worth knowing.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Read each sentence of the sign separately.
Show the answer
Answer: C. Directive and deterrent: a rule, and a warning.
Directive and deterrent. “Authorised staff only” tells people the rule; “Every entry is recorded” makes someone thinking of breaking it think twice.
Apply it
Show the answer
Answer: A. A compensating control for the missing record.
A compensating control: the preferred control (the door system’s record) cannot be used, so the guard’s log reaches a similar objective by another route.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Categories
Show answer
Answer: Managerial, operational, technical and physical
The four control categories are managerial, operational, technical and physical. A category describes how a control is implemented, which is a separate question from what the control does. Preventive, detective, corrective and deterrent answer that second question, so they are not categories. The other two lists are not about classifying controls at all: one names security properties, and the other names functions from a cybersecurity framework.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Managerial, because it is a governance decision recorded as a policy
Managerial controls are governance, oversight, policy and risk-management mechanisms, and policies are an example. For a control that seems to fit more than one category, there is a test: ask what mainly makes it work. What is described here is the policy, a decision made by those who run the organisation, so it is managerial. Staff will follow the requirement, but what is being classified is the decision itself, not their day-to-day actions. The multi-factor authentication system that later enforces the policy is a separate control, and that one is technical.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Stewards carrying out procedures: operational
The analogy treats a football club and its stadium as an organisation. Executives and management set the policies and rules, which is managerial. Stewards and staff carry out the procedures, which is operational. Technology performs or enforces a function, which is technical. Gates, barriers, turnstiles and locked areas are physical. Stewards are people following a process, so they are the operational part of the analogy, while the turnstiles they stand beside are the physical part.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record)
Show answer
Answer: False
False. The managerial category means governance and oversight mechanisms, such as policies and risk assessments, and not the managers themselves. Managerial controls are often explained in terms of management and board oversight, which is where the confusion can start. A manager who carries out a practical task, such as checking that doors are locked, is performing an operational control, because it works through a person following a process. The category is decided by how the control works, not by the job title of whoever is involved.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Encryption: technical; Security awareness training: operational; A door lock: physical
Each category of the four-category model has typical examples. Encryption and firewalls are technical, because technology implements or enforces them. Security awareness training is operational in this model, because it works through people and processes; a three-category model would call the same training administrative. Locks are physical, because they protect buildings, equipment and physical access. A risk assessment is managerial, a governance and risk-management mechanism, so pairing it with physical is wrong, and a firewall is technical, so pairing it with managerial is wrong.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: An acceptable-use policy; Background checks on new staff; A security awareness training programme
Administrative controls are based primarily on policies, procedures, governance, organisational rules, and people and processes. An acceptable-use policy, background checks and a training programme all work that way. Full-disk encryption works through technology, so it is technical, and a turnstile is a physical barrier, so it is physical. In this three-category model the policy and the training are both administrative, whereas the four-category model would place the policy under managerial and the training under operational.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Administrative, because it works through a required procedure
Administrative controls work primarily through policies, procedures, governance and organisational rules, and change-management procedures are among the examples. Requiring approval and documentation before a change is a procedure that people follow, so it is administrative. A ticketing system may record the approval, but the tool is not what makes the control work, so it is not technical, and nothing here is a barrier to a building or to equipment, so it is not physical. Detective is a functional type, describing what a control does, and is not one of the three categories.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: The documents use different models, which divide controls differently.
Frameworks divide controls differently. A three-category model uses administrative, technical and physical, and there a training course is administrative. The four-category model uses managerial, operational, technical and physical, and there the same course is operational, because it works through people and processes. Neither document is wrong, and the difference is not that one looks at governance and the other at delivery: each names the same course within its own model. Administrative is not simply another name for managerial either, because it also covers most of what the four-category model calls operational.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Functional types
Show answer
Answer: True
True. A security control reduces risk: it normally lowers the likelihood of harm, the impact, or both, and it does not necessarily remove the threat or the vulnerability. Multi-factor authentication makes a stolen password much less useful, but the attacker and the stolen password still exist. A common working definition, something used to mitigate a vulnerability or threat, points the same way: to mitigate is to reduce, not to remove.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Before: preventive. During: detective. After: corrective.
Of the six functional types, three fit on a timeline around an incident. A memory aid: preventive is before, detective is during and discovers, and corrective is after and fixes. A preventive control, such as a locked door, acts before an incident to stop it. A detective control, such as log monitoring, discovers that something is happening. A corrective control, such as restoring from backup, puts things right afterwards. The other options use the right three names and attach them to the wrong moments.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: The first is directive; the second is deterrent
A directive control tells people what they are expected to do, and a deterrent control discourages unwanted behaviour; warning signs and visible CCTV are examples of deterrents. The first notice is an instruction to people who intend to follow the rules, so it is directive. The second warns anyone thinking of misbehaving that they may be seen, so it is deterrent. A notice does not itself stop anyone, which is why neither is preventive, and it is the camera, not the notice about it, that detects.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Allowing access to it only from a trusted network, through a monitored jump host
A compensating control is an alternative safeguard used when the preferred control cannot be implemented. For a legacy system that cannot support MFA, restricting access to trusted networks and requiring a jump host are examples. A compensating control must stand in for the missing control and reach a similar objective another way. Extra car-park cameras do nothing for the missing MFA, an exemption with no action leaves the gap open, and longer usernames are not a second kind of proof.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Detective, deterrent or both, depending on how it is used
CCTV is detective, deterrent or both, depending on use. Monitoring or reviewing the footage discovers incidents, which is detective, and a visible camera discourages them, which is deterrent. A camera does not physically stop anyone, so it is not preventive, and reviewing footage afterwards discovers what happened without putting anything right. The category is a separate question: CCTV is commonly classed as physical, although some sources treat cameras as technical, so it is worth checking which taxonomy is in use.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: Multi-factor authentication: technical and preventive; A security policy: managerial and directive
Two classification examples: multi-factor authentication is technical and preventive, and a policy is managerial and directive. Multi-factor authentication is enforced by technology and acts before an incident, by stopping a sign-in that has only a password, so it is preventive and not detective. A policy does tell people what is expected of them, so it is directive, but it is a governance document and not a task that staff carry out, so it is managerial and not operational. Category and function are separate questions, and a description is correct only when both halves are right.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Show answer
Answer: It substitutes for a preferred control that cannot be used.
A compensating control is an alternative safeguard used when the preferred control cannot be implemented. It is not simply extra security: it must stand in for a specific control that cannot be used, and reach a similar objective another way. Adding a control on top of existing ones does not make it compensating. Repairing damage after an incident is what a corrective control does. A compensating control may last for as long as the preferred control is unavailable, and it is not defined by whether a risk has been accepted.
Revision sources: Security Controls: Categories and Functions (Supplementary Study Guide explanation)
Study and revision
Practise through the Security Principles & Controls topic. Questions cover the four categories, descriptions that point at the wrong category, administrative controls and the different models, what a control does to a risk, the six functional types, compensating controls and classifying a control both ways; nine flashcards recall the two questions, the categories, the stadium analogy, the timeline memory aid, directive, deterrent and compensating controls, administrative controls and how the control models differ. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 1.1 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- A control reduces risk, by lowering likelihood, impact or both. It rarely removes the threat.
- Category asks how a control is implemented: managerial, operational, technical or physical.
- Functional type asks what it does: preventive, detective, corrective, directive, deterrent or compensating.
- Describe every control both ways, and expect some to have more than one function.
- Check which model a document uses before applying its labels.
Key terms
- Control
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
- Managerial control
A control that works through governance, oversight, policy and risk management, such as a security policy or a risk assessment.
- Operational control
A control carried out primarily by people following processes, such as security awareness training or an incident-response procedure.
- Technical control
A control implemented or enforced by technology, such as multi-factor authentication, encryption or a firewall.
- Physical control
A control that protects buildings, equipment and physical access, such as a lock, a barrier, CCTV (closed-circuit television) or a badge-controlled door.
Common misunderstandings
A control normally reduces the likelihood or the impact of harm. The threat usually still exists, and some risk remains.
The category means governance mechanisms: policies, oversight and risk assessment. People carrying out tasks are operational.
They are functional types. Categories are managerial, operational, technical and physical. Every control has an answer in each list.
It is a substitute for a specific control that cannot be used, reaching a similar objective another way.
A camera does not physically stop anyone. It discovers incidents and discourages them, so it is detective, deterrent or both.
Further reading
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 7 (see the Session 7 Learning Log): the working definition of a control; the four categories, with managerial controls explained in terms of management and board oversight; the football-stadium analogy, including VAR as an analogy for technical controls; the six functional types; and the term Administrative (Management) Controls.
- Accuracy qualifications: a control reduces risk and does not necessarily remove a threat or vulnerability; the managerial category means governance and oversight mechanisms, not the managers themselves; VAR is an analogy, not a cybersecurity control; a compensating control is an alternative safeguard, not simply extra security; and “administrative”, “managerial” and “management” are not defined identically in every framework.
- Supplementary explanation: the fuller definition of a control, the meaning and examples given for each category and functional type, the before, during and after memory aid and the other memory aids, the legacy-system example of compensating controls, the classification examples, the definitions of threat, vulnerability and risk used here, all three diagrams, the test for choosing a category and the table of misleading descriptions, the note on security guards, the comparison of directive and deterrent controls, the explanation of legacy systems and jump hosts, the examples of administrative controls, the three models of control categories, the comparison with Defence in Depth, the practical note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagrams are original.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the sorting opening questions, every question asked in the lesson with its feedback and hints, the password-handling, USB, poster, shredder, pharmacy and server-room examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not selected, implemented or assessed controls for an organisation as part of this lesson.
A control based primarily on policies, procedures, governance, organisational rules, and people and processes, as opposed to technology or physical barriers.
An alternative safeguard used when the preferred control cannot be implemented, reaching a similar security objective another way.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A control that puts things right after an incident, such as restoring from backup, removing malware or reconfiguring a compromised system.
A control that makes suspicious or unwanted activity visible, such as monitoring unusual sign-ins.
A control that discourages unwanted behaviour, such as visible CCTV (closed-circuit television), a warning sign or a banner stating that a system is monitored.
A control that tells people what they are expected to do, such as a policy, a procedure or a mandatory instruction.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
A control that allows or blocks network traffic according to configured rules.
An entry in a firewall policy that combines conditions, such as source, destination, protocol and port, with an action: allow or deny.
The direction, accountability and oversight through which an organisation sets and checks its security decisions.
An endpoint that sends or receives data on a network. Hosts are nodes, but not every node is an end host.
How serious the consequences of an event would be for the organisation and the people affected.
How probable it is that a defined event will happen over a stated period.
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
A control that works through governance, oversight, policy and risk management, such as a security policy or a risk assessment.
Authentication that requires two or more different types of factor, such as something you know and something you have.
A control carried out primarily by people following processes, such as security awareness training or an incident-response procedure.
A control that protects buildings, equipment and physical access, such as a lock, a barrier, CCTV (closed-circuit television) or a badge-controlled door.
A document that sets organisational rules and expectations, defining what is and is not permitted.
A control that reduces the chance of an attack or mistake succeeding, such as restricting access or filtering deceptive emails.
Step-by-step instructions explaining how a particular task should be carried out.
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A control implemented or enforced by technology, such as multi-factor authentication, encryption or a firewall.
A potential cause of harm, such as an attacker seeking unauthorised access.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.