Risk Response and Reporting · Topic 4 of 9
Control Frameworks, Types and Standards
CRISC control types and frameworks: preventive, detective, corrective and more; administrative, technical, physical; ISO/IEC 27001, NIST 800-53, CIS, COSO.
- 4 min
- Functions: directive, deterrent, preventive, detective, corrective, recovery, compensating.
- Categories: administrative, technical, physical; and manual versus automated.
- General IT controls underpin application controls.
What it is
A control is any measure that modifies risk: a policy, procedure, technical setting, physical barrier or practice. Controls are described by their function (what they do in relation to an event) and their category (how they are implemented).
Control frameworks are published catalogues of controls and control objectives. They help an organization choose a complete, recognized set of controls and show regulators and customers that it follows good practice.
How it works
Control functions
| Function | Purpose | Example |
|---|---|---|
| Directive | Tells people what to do | Acceptable use policy, standards |
| Deterrent | Discourages an attempt | Warning banners, visible cameras |
| Preventive | Stops the event from happening | Access control, input validation, segregation of duties |
| Detective | Identifies an event that has happened or is happening | Log monitoring, reconciliations, intrusion detection |
| Corrective | Limits damage and fixes the cause | Patching after an incident, quarantining malware |
| Recovery | Restores normal operation | Backup restore, failover to a DR site |
| Compensating | Alternative when the preferred control cannot be used | Extra monitoring on a system that cannot be patched |
Preventive controls are usually preferred because they stop the loss, but no preventive control is perfect. A balanced design combines prevention with detection and correction.
Control categories
| Category | Also called | Examples |
|---|---|---|
| Administrative | Managerial, procedural | Policies, training, background checks, access reviews |
| Technical | Logical | Encryption, firewalls, MFA, automated alerts |
| Physical | Environmental | Locks, badges, fire suppression |
Controls are also manual or automated. Automated controls run consistently and can be tested once and relied on until changed, provided change control is effective. Manual controls depend on people and need more frequent testing.
General IT controls (access, change management, operations) support the reliability of application controls (input, processing and output checks inside business systems). Weak general controls undermine every application control that depends on them.
Common control frameworks
| Framework | Content |
|---|---|
| COBIT 2019 | 40 governance and management objectives for enterprise IT |
| ISO/IEC 27001:2022 | ISMS requirements with Annex A listing 93 controls in four themes: organizational, people, physical and technological |
| ISO/IEC 27002:2022 | Guidance on implementing those controls |
| NIST SP 800-53 Rev 5 | Large catalogue of security and privacy controls in 20 families, with baselines in SP 800-53B |
| CIS Critical Security Controls | Prioritized set of 18 controls with implementation groups for different sizes of organization |
| COSO Internal Control (2013) | Five components: control environment, risk assessment, control activities, information and communication, monitoring activities |
| NIST CSF 2.0 | Outcomes under six functions: Govern, Identify, Protect, Detect, Respond, Recover |
Frameworks overlap heavily. Organizations often adopt one as the primary framework and map others to it, so one control can satisfy several requirements.
Choosing a framework
The choice depends on regulation, industry, customer expectations, and the organization's size and maturity. A small company may start with the CIS Controls; a US federal agency follows NIST SP 800-53; an organization seeking certification uses ISO/IEC 27001. Whatever is chosen should be tailored, not adopted blindly.
A worked example
A fintech handles card payments and also sells to European banks that ask for ISO/IEC 27001 certification. It must meet PCI DSS requirements as well.
The practitioner recommends ISO/IEC 27001 as the primary framework and maps PCI DSS requirements onto its Annex A controls. For the payment card environment, the team adds detective controls (file integrity monitoring and daily log review) alongside preventive network segmentation, so a failure of one control is caught by another.
How the exam asks about this
- "Which type of control is a daily reconciliation of payments to bank statements?" A detective control.
- "Why should general IT controls be assessed before relying on application controls?" Weak access or change controls could allow application controls to be bypassed or altered.
- "What is the BEST reason to map multiple frameworks to one control set?" To meet overlapping requirements with fewer controls and consistent evidence.
What to remember for the exam
- Functions: directive, deterrent, preventive, detective, corrective, recovery, compensating.
- Categories: administrative, technical, physical; and manual versus automated.
- General IT controls underpin application controls.
- ISO/IEC 27001:2022 Annex A has 93 controls in four themes.
- NIST CSF 2.0 has six functions, starting with Govern.
Do not confuse a control's function with its category. Encryption is a technical category control with a preventive function; an access review is an administrative control with a detective function.
Common mistakes
Relying only on preventive controls. When they fail, nothing detects or limits the damage.
Testing manual and automated controls the same way. Automated controls with sound change control can be tested less often; manual controls need more.
Adopting several frameworks separately. Without mapping, teams duplicate controls and evidence.
Check yourself
Give one example each of a preventive, detective and corrective control.
Preventive: multifactor authentication; detective: log monitoring or reconciliation; corrective: patching the exploited flaw or quarantining malware after an incident.
Why do weak general IT controls matter to application controls?
Application controls rely on secure access and change management; if those are weak, application controls can be changed or bypassed.
What are the four themes of ISO/IEC 27001:2022 Annex A?
Organizational, people, physical and technological controls.
Topic 4 of 9 in Risk Response and Reporting
Test yourself on Risk Response and Reporting
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.