TechKnowSurge
ISC2 CC 1.4 CompTIA A+ Core 2 2.1 Cisco CCST Cybersecurity 1.1 NIST CSF PR.AA-06 NIST CSF GV.PO-01
TechKnowSurge Catalog Videos Protection - Types of Controls
VideoSecurityFree

Protection - Types of Controls

Cybersecurity controls are the countermeasures organizations use to manage risk, and they fall into three categories—technical, physical, and administrative—as well as several functional types, including preventative, detective, corrective, and more. Understanding how these controls are classified helps organizations build layered, effective security strategies.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Every organization is exposed to cybersecurity risks, and managing those risks begins with a formal risk assessment to identify potential threats and evaluate their likely impact. From there, organizations choose a response strategy—avoiding the risk entirely, reducing its impact, transferring it through mechanisms like insurance, or accepting it. The practical tools used to carry out these strategies are called controls or countermeasures, and they represent the concrete steps an organization takes to limit exposure or minimize damage when something goes wrong. Controls are organized into three categories based on how they are implemented. Technical controls include the hardware and software used to protect systems and data, such as firewalls, intrusion prevention systems, antivirus programs, and encryption. Physical controls protect the tangible environment, including surveillance cameras, locked storage, and access-restricted facilities. Administrative controls operate at the management level through policies, procedures, and checklists that guide how technical and physical controls are selected, implemented, and maintained. In addition to category, controls are classified by the functional role they serve. Preventative controls stop a threat from materializing, such as disabling a vulnerable service before it can be exploited. Deterrent controls raise the cost or difficulty of an attack without eliminating the possibility entirely, making malicious action less appealing. Detective controls identify when an incident is occurring or has occurred, typically through alerts, monitoring systems, or log review. Corrective controls address an active problem by closing the exposure, while recovery controls focus on understanding the full scope of damage and restoring normal operations. Compensating controls offset a known weakness—such as carrying cybersecurity insurance—and directive controls are driven by external requirements like laws, regulations, or contractual obligations. One important aspect of this framework is that a single control can serve multiple functions at once. Surveillance cameras, for example, act as a deterrent by discouraging would-be attackers, function as a detective tool by capturing evidence of an incident, and may also satisfy a directive requirement if regulations mandate their use. Recognizing these overlapping roles allows security teams to assess their control environments more accurately and identify gaps that a single-function view might miss.

What you'll learn

What's covered

Cybersecurity Control Types

Aligned to

ISC2 CC
1.4 Understand cybersecurity controls
CompTIA A+ Core 2
2.1 Summarize various security measures and their purposes.
Cisco CCST Cybersecurity
1.1 Define essential security principles
NIST CSF
PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk.
GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.

Key terms

Risk
The potential for loss or harm resulting from a threat exploiting a vulnerability.
Risk Assessment
The process of identifying, analyzing, and evaluating risks to determine their potential impact.
Risk Management
The ongoing process of identifying, assessing, and mitigating risks to an acceptable level.
Technical Control
A security control implemented through technology — such as firewalls, antivirus software, encryption, or access control systems — rather than through physical measures or administrative policies.
Administrative Control
A cybersecurity control based on policies, procedures, and checklists that guide how an organization manages and implements its security practices.
Physical Control
A security control that protects assets through tangible, real-world measures — such as locks, security cameras, mantraps, fences, and safes — to prevent unauthorized physical access or tampering.
Preventative Control
A security control designed to stop a threat or incident from occurring in the first place. Firewalls, encryption, and access control policies are common examples of preventative controls.
Deterrent Control
A security control that discourages threat actors from attempting an attack by making the environment appear more difficult or risky to compromise. Warning banners, visible cameras, and security signage are common deterrent controls.
Detective Control
A security control that identifies and alerts on security incidents or anomalous activity as they occur or after the fact. Intrusion detection systems, security logs, and audit trails are examples of detective controls.
Corrective Control
A security control that addresses and remediates a security incident after it has been identified — such as restoring systems from backup, patching a exploited vulnerability, or blocking an attacker's IP address.
Recovery Control
A security control designed to restore systems, data, and normal operations after a security incident has been identified and contained. Backup restoration, disaster recovery procedures, and system reimaging are examples of recovery controls.
Compensating Control
An alternative security measure implemented to offset a known risk or vulnerability when a primary control cannot be fully applied. A compensating control must provide an equivalent or greater level of protection.
Directive Control
A security control mandated by laws, regulations, or customer requirements that an organization must implement with no discretion. Examples include legally required data retention policies and mandatory breach notification procedures.

Topics

Cybersecurity Controls Risk Management Preventative Controls Detective Controls Administrative Controls Physical Security Cybersecurity

Transcript

When it comes to cyber security controls, there are several different types of controls that we can implement on our networks, in our companies, in our organizations, to make sure that we're protecting them from a cyber security standpoint.

Risk and Countermeasures

Our organizations are going to be exposed to certain risks. What we need to do is identify what those risks are, so we're going to do a risk assessment to identify those risks. From there we'll figure out what the impact would be if those risks were actualized, if they were to actually happen. So that is the risk management process.

Based off of what we find, we may take several different strategies for each one of those risks. One thing we might do is do something to avoid the risk altogether. Maybe we reduce the impact if that risk were to actually take place. Or maybe we'll transfer it to something else, like insurance — we'll take out extra insurance. Or maybe we will accept the risk. So there's several different actions or strategies that we can take.

We call these countermeasures. Countermeasures are the steps that we take and put into place to make sure something is not going to happen, or to reduce the impact if it does happen. So really it's the things that we're going to do. We also call them controls: there are certain controls that we put into place to control the amount of risk.

The Three Categories of Controls

When we put countermeasures or controls into place, what we're doing is putting something into place that can fall into one of three different categories.

The first one is technical. This would be like a firewall, or an intrusion prevention system, or perhaps it's an antivirus. These are the technical controls. It's the software and hardware that we put into place to protect the data flow, to protect the data on our laptops, that we encrypt things. For instance, maybe we encrypt backups. So that is a technical control, when we encrypt a backup.

On the other side of this spectrum is going to be physical controls. Maybe we do encrypt that data that we're backing up, so we have encrypted data on our backup media — well, that would be a technical control. But maybe we also store that in a safe, and now that would be a physical control. Maybe we have cameras that are surveying that to make sure that no one breaks into it. That would be another physical control.

Then we have administrative controls. Administrative controls are more of the management side of this, the administrative side of this. These are like the checklists that we follow. These are like the policies that we follow. These are the things that we put into place from an administrative level to make sure that we're carrying out our processes and doing things correctly, to make sure we're implementing correct technical and physical controls.

So those are the three different categories: technical, administrative and physical controls are the different categories that these controls fall into.

The Types of Controls

So what are the different types of controls?

The first one we have is preventative. That just means that it stops something from happening. We put up a barrier that's just going to stop something from happening altogether. For instance, maybe we have a service that has a vulnerability to it, and we determine that the risk is not worth the service — let's just turn down the service. That would be preventative. We've turned down the service so that way it just doesn't exist anymore; there's no one that can leverage that service.

We also have deterrence. Think of like a fence, or maybe a barbed wire. There are ways to get around barbed wire, but I certainly don't want to crawl over a barbed wire that's going to get me all scraped up and scratched up. It's not something that I'm going to really do, so it's a deterrent — something that I don't want to do, that's going to deter me from doing something. I could do it, I could figure it out, but I'm not going to, because what's the point? So it's just something that puts a barrier up that's higher, that makes it less appealing to try to get to whatever's on the other side than really what the deterrent has in front of it. So that's a deterrent.

Then there's the detective. Detective is the idea that we are going to detect if something happens. So if we use the barbed wire again, maybe I've got some sensors that, if somebody were to clip that barbed wire or crawl over there, then it would alert me that something is happening. So think alert in this case right here. Or I can go in and look at logs and see what's happening with it; I can find additional information with this. So that's the detective side of this.

Then there's the corrective side. What happens is when there is a security incident — maybe somebody left the door open — this is going and closing the door, right? So if somebody opened the gate up to a secure area and now it's open, and I discover, oh, we have an exposure here, so now what I'm going to do is close that gate.

Corrective and recovery can look very similar, right? Because corrective is closing that gate. But what is recovery? Now that the gate's closed, I have to discover what happened. Did somebody walk into the gate while it was open? Are there any traces that somebody left when they were behind that gate? So I need to go through this recovery process to fix whatever happened. And there's going to be damage — let's say somebody did walk into the gate and they stole information. What am I going to do now to actually recover from this incident? So corrective is the idea of correcting for the action, but recovery is, okay, we've corrected the problem, now we have to go through the recovery process after we corrected it.

Then we've got compensating. This is the idea that when we have an issue, or let's say we suspect that there's going to be an issue, we do some sort of compensation for it. Maybe we go out and get cyber security insurance. So that's going to compensate for maybe some sort of vulnerability that we have.

And then finally we have here is directive, and that's going to be something that is specified for us, that's dictated for us. So an example of this is maybe some laws and regulations. Perhaps maybe our customers are demanding it. So something that's directing us that says, no, you don't really have a choice, you have to do this.

Controls Can Be More Than One Type

One thing to note is that our controls could actually fall under multiple types at the same time. An example of this is our surveillance cameras. A surveillance camera is a deterrent: if a criminal knows that there are surveillance cameras and that they can't bypass these surveillance cameras, they may be less likely to break into somewhere. It's also detective, meaning that we could actually see if somebody's breaking in, or after the fact go and review the footage to find out what happened and who was the perpetrator. So that is a detective type right there. And then the other thing is it could also be directive, and that means that there is some sort of regulation that says that we have to have surveillance cameras. So we could actually have a control that's part of multiple types here.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →