Objective 1.1: Compare and contrast various types of security controls
Cert: CompTIA Security+ (SY0-701) Domain: 1.0 General Security Concepts Weight: ~12% of SY0-701 (Domain 1 total) Depth: Compare and contrast. Be able to name the four control categories (Technical, Managerial, Operational, Physical), the six control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive), and classify any real-world safeguard along both axes.
What this objective tests
You should be able to name the four control categories, the six control types, and put any safeguard into the right cell of a 4-by-6 grid. Auditors ask for this by name. Cyber-insurance questionnaires list controls by these categories. Risk registers organize line items by these types. A SOC (Security Operations Center) Tier 1 analyst who can name a category and a type for any safeguard speaks the language of the people writing the policy and the people reading the audit report.
Key facts
The four control categories
Categories answer the question: who or what enforces this?
| Category | Plain English | Real example |
|---|---|---|
| Technical | Hardware or software enforces it | Firewall, antivirus, MFA (Multi-Factor Authentication), disk encryption, IDS (Intrusion Detection System) |
| Managerial | Policy and process enforce it | Information security policy, vendor review process, annual risk assessment, AUP (Acceptable Use Policy) |
| Operational | People doing day-to-day work enforce it | SOC morning log review, on-call rotation, security awareness training sessions, HR offboarding checklist |
| Physical | The real-world building and grounds enforce it | Bollards, fences, mantraps (access control vestibules), CCTV (Closed Circuit Television), locked badge-reader doors, lighting |
The category answers ownership and enforcement. A locked door is Physical because the building enforces it. A policy that requires the door to be locked is Managerial because policy enforces it. The Tier 1 analyst who checks the door every morning is Operational because a person enforces it on a routine. The badge reader that records every entry is Technical because hardware and software enforce it.
The six control types
Types answer the question: what does the control actually do?
| Type | Plain English | Real example |
|---|---|---|
| Preventive | Stops the bad thing before it happens | Firewall blocks the connection, MFA stops the stolen-password login, locked door denies entry |
| Deterrent | Makes the attacker decide not to try | Visible CCTV camera, warning sign at the entrance, "this system is monitored" login banner |
| Detective | Notices when something bad happens or has happened | IDS alert, SIEM (Security Information and Event Management) correlation, log review, camera recording reviewed after a break-in |
| Corrective | Fixes the damage after the fact | Backup restore, reimaging an infected laptop, running the incident response playbook, emergency patch deployment |
| Compensating | Workaround when the primary control cannot be used | Manual log review while the SIEM is offline, software authenticator on personal phones when hardware tokens are out of budget, network segmentation around a legacy system that cannot be patched |
| Directive | Tells people what to do | AUP, written incident response procedure, USB device standard, login warning banner |
Most safeguards have more than one type. A bollard is Preventive (blocks the vehicle) and Deterrent (the driver sees the bollard and decides not to try). An AUP is Directive (states the rules) and arguably Deterrent (the penalty clause discourages misuse). When listing types for a safeguard, name the strongest type first and the secondary types after.
The 4-by-6 grid
The grid is the artifact. Categories across the top, types down the side. Every safeguard fills exactly one column and at least one row. Auditors walk the grid cell by cell. Empty cells become audit findings. Filled cells become evidence in the security plan.
A short worked example. The audit finding reads: "No detective control on user account changes." Translation: cell (Detective, Technical or Operational) is empty. The remediation is to deploy a detection method (Technical) such as alerting on changes to a privileged group, or to add a routine (Operational) such as a weekly review of the account-change audit log. Either fills the cell.
Common gotchas
- Deterrent vs Preventive. A sign on the door does not lock it. A locked door does. Deterrent works on minds; Preventive works on actions. If the safeguard physically blocks the action, it is Preventive. If it only changes the attacker's decision-making, it is Deterrent. A visible CCTV camera that records is both: the visibility deters, the recording is detective.
- Compensating vs Corrective. Corrective fixes the damage after an incident (restore from backup). Compensating substitutes for a missing or unavailable primary control (manual log review while the SIEM is down). If the question is "what brings the system back," it is Corrective. If the question is "what stands in for the control we cannot deploy right now," it is Compensating.
- Managerial vs Operational. Managerial is the policy or process on paper. Operational is the people-doing-the-work that the policy describes. The information security policy is Managerial. The Tier 1 analyst who runs the morning log review the policy requires is Operational. The two work together but they are not the same category.
- Forgetting Directive is a category of type. A written rule that tells people what to do is a control. An AUP is a Directive control. A warning banner at login is a Directive control. Students from a pure-hardware background sometimes leave Directive off the list. Do not.
- Putting safeguards in the wrong category because of who paid for them. A firewall paid for by the IT budget is still Technical. A locked door installed by the facilities team is still Physical. Category is about what does the enforcing, not who owns the line item.
- Calling a Detective control "Preventive enough." Detective controls notice. They do not stop. An IDS alone does not stop the attack; it tells you the attack is happening. Pair detection with a response process to get from detection to prevention of the next incident.
- Listing every type for every safeguard. Some safeguards have one type. A backup restore is Corrective. Not Preventive, not Detective. List only the types that genuinely apply.
Real-world context
In a SOC Tier 1 analyst seat, the 4-by-6 grid shows up on every ticket. The triage question is "which control failed?" If the missing control was Preventive, root cause is a prevention gap. If it was Detective, the alert pipeline missed the activity and detection coverage needs investigation. If it was Directive, a person did something the policy already said not to do, and training and discipline need investigation. If it was Compensating, the workaround is not working, and the team needs to fund the primary control.
In a cyber-insurance renewal questionnaire the carrier asks "do you have a Detective control on user account changes? Do you have a Corrective control with offsite backups? Do you have a Directive control with an AUP every employee signs?" Each question maps to a cell. The questionnaire is a grid walk in another format.
In an audit report the finding language follows the same pattern. "The organization has no Detective control over privileged account use." "The organization relies on a Compensating control where a primary Technical control would be appropriate." "The Directive control (AUP) has not been updated since 2023." Each sentence names the cell and the gap.
A worked example from a small business. Pine Ridge Dental is a five-person dental office. Their cyber-insurance carrier sends a renewal questionnaire. The office manager calls the SOC. The SOC analyst walks the grid:
- Preventive (Technical): Enable MFA on the email service and the patient-records server. Stops stolen passwords.
- Detective (Operational): The office manager reviews the patient-records access log monthly. Catches a staff member viewing records they should not view.
- Corrective (Technical): Encrypted nightly backup of the patient-records server to offsite cloud storage. Recovers patient records after a ransomware incident.
- Directive (Managerial): AUP every employee signs. Sets the rules for using office systems and patient data.
- Compensating (Technical): If a small-business firewall is not affordable, disable guest Wi-Fi on the cable-company router and change the default admin password. Lower-cost substitute for proper network segmentation. Document the trade-off and revisit at the next budget cycle.
The grid walk turned a vague questionnaire into a five-line plan.
Sources
- CompTIA Security+ SY0-701 Exam Objectives, Section 1.1
- NIST SP 800-53 Rev. 5, Security and Privacy Controls
- NIST Cybersecurity Framework (CSF) 2.0
- ISO/IEC 27001:2022, Annex A controls
- PCI DSS v4.0 Requirement 12 (Policy)
- CIS Critical Security Controls v8