General Security Concepts · Topic 3 of 7
Security Control Categories and Types
Learn the four Security+ control categories and six control types, with examples, so you can classify any safeguard that an exam scenario describes.
- 5 min
- There are four categories: technical (logical), managerial (administrative), operational and physical (environmental).
- There are six types: preventive, deterring, detective, corrective, compensating and directive.
- A firewall is technical and preventive. An IDS is technical and detective.
What it is
A security control is any safeguard that reduces risk to an organization's people, systems or data.
Security+ sorts controls in two ways. The category says what the control is made of or who carries it out: technical, managerial, operational or physical. The type says what the control does about an event: preventive, deterring, detective, corrective, compensating or directive.
Every control has a category and at least one type. A firewall is a technical control, and its type is preventive.
How it works
Controls are layered so that when one fails, another catches the problem. Knowing the category and type of each control helps you see which layers are missing.
The four categories
| Category | Also called | Carried out by | Examples |
|---|---|---|---|
| Technical | Logical | Hardware, software or firmware | Firewall, encryption, antivirus, access control lists |
| Managerial | Administrative | Management, through planning and oversight | Risk assessment, security policy, vulnerability management program |
| Operational | None | People, through day to day processes | Awareness training, guard patrols, incident response procedures |
| Physical | Environmental | Tangible things in the real world | Locks, fences, badge readers, cameras, fire suppression |
Operational controls depend on staff following a process, while technical controls work without a person acting each time. Managerial controls set the direction that the other categories carry out.
Physical and environmental controls
Physical controls keep unauthorized people away from equipment. Environmental controls protect equipment from conditions that could damage it or take it offline.
| Physical | Environmental |
|---|---|
| Fences, gates and bollards | Heating, ventilation and air conditioning (HVAC) |
| Door locks and badge readers | Temperature and humidity monitoring |
| Security cameras and lighting | Fire detection and suppression |
| Locked racks and cabinets | Water leak sensors |
Environmental controls mostly protect availability. An overheated server room can stop services just as surely as an attack.
The six types
| Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop an event before it happens | Firewall, lock, least privilege, intrusion prevention system (IPS) |
| Deterring | Discourage someone from trying | Warning signs, visible cameras, bright lighting |
| Detective | Find an event that is happening or has happened | Log review, intrusion detection system (IDS), motion sensor |
| Corrective | Limit damage and restore normal operation | Restore from backup, apply a patch, quarantine malware |
| Compensating | Stand in when the main control is not possible | Extra monitoring on a system that cannot be patched |
| Directive | Tell people what they must or must not do | Policy, standard, procedure, signed acceptable use rule |
A single control can fit more than one type. A visible security camera deters, and its recording also helps detection.
Reading a scenario
Ask two questions in order. First, what is the control made of: a device or program, a rule or document, a person following a process, or a physical item? Second, what does it do in relation to the incident: block it, discourage it, notice it, repair it, replace a missing control or instruct people?
How the exam asks about this
- "A sign on the fence warns that the area is monitored." -> Physical category, deterring type.
- "A legacy controller cannot be patched, so it is placed on an isolated network with extra logging." -> Compensating control.
- "The security team publishes a rule that all laptops must use full disk encryption." -> Managerial category, directive type.
What to remember for the exam
- There are four categories: technical (logical), managerial (administrative), operational and physical (environmental).
- There are six types: preventive, deterring, detective, corrective, compensating and directive.
- A firewall is technical and preventive. An IDS is technical and detective.
- A written policy is managerial and directive. Awareness training is operational.
- A lock, fence, bollard or badge reader is physical. HVAC and fire suppression are environmental.
- Restoring from backup is corrective because it repairs damage after an event.
- A compensating control is used when the normal control cannot be applied, and it must give similar protection.
- A deterring control works on the person's decision. A preventive control actually blocks the action.
When a question names both a category and a type, answer each one separately and pick the option that fits both.
Common mistakes
Mixing up category and type. "Technical" and "preventive" answer different questions, so an option that offers one where the other is asked is wrong.
Treating detective as preventive. An alert that tells you an attack happened does not stop it, even if people react quickly afterward.
Calling every policy operational. Policies and risk programs set direction and belong to the managerial category. The people who follow the process day to day are operational.
Confusing deterring and preventive. A sign that says "Authorized staff only" discourages. A locked door actually stops entry.
Using compensating as a word for "backup". A compensating control replaces a control that cannot be used, such as isolating a legacy server because it cannot take security updates.
Some controls fit two types. If the question asks for the primary purpose, choose the type that describes the main job of the control.
Check yourself
Which category does a badge reader on a server room door belong to?
Physical, because it is a tangible barrier. Its type is preventive.
A company cannot patch an old industrial controller, so it adds network isolation and extra monitoring. What type of control is this?
Compensating, because it replaces the missing patch control with similar protection.
What is the difference between a detective and a corrective control?
A detective control finds an event, such as an IDS alert. A corrective control repairs the damage, such as restoring from backup.
Topic 3 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.