Simple explanation
Every security control can be described two ways: what kind of thing it is (category), and when it acts relative to a bad event (type). A locked door is a physical, preventive control. A camera is a physical, detective control. Knowing both axes lets you answer "which control fits this scenario" questions precisely instead of guessing.
Technical explanation
Categories (what the control IS):
- Technical — enforced by systems: firewalls, encryption, ACLs, MFA.
- Managerial — governance and planning: risk assessments, policies, security awareness programs.
- Operational — enforced by people day-to-day: guards, training, incident response procedures.
- Physical — tangible barriers: locks, fences, badge readers, mantraps, lighting.
Types (WHEN the control acts):
- Preventive — stops the event before it happens (firewall rule, MFA, door lock).
- Deterrent — discourages an attempt without physically stopping it (warning signs, visible cameras).
- Detective — identifies that something happened (IDS, audit logs, security cameras reviewing footage).
- Corrective — reduces impact after the fact (backups, patching, incident response).
- Compensating — an alternative when the primary control isn't feasible (isolating an unpatchable legacy server on its own VLAN).
- Directive — tells people what they must do (policies, standard operating procedures, signage mandating badge use).
A single control can belong to one category and one type simultaneously — a fence is Physical + Preventive; a policy requiring background checks is Managerial + Preventive.
Synonyms / related terms
| Term | Means | |---|---| | Managerial control | Sometimes still called "administrative control" on older material | | Safeguard | Generic synonym for control | | Countermeasure | Another generic synonym, often used for technical controls specifically |
Concept Check
"A company posts 'Area under 24-hour video surveillance' signs at every entrance, whether or not cameras are recording. What TYPE of control is this?" It's tempting to say Detective (there are cameras) — but the signage itself, regardless of whether footage is reviewed, exists to discourage the attempt. That makes it Deterrent. If the question instead asked about the cameras actually catching an intruder after entry, that's Detective.
Interview-style Q&A
Q: Give a real example of a compensating control. A: "A legacy server couldn't be patched without breaking a vendor application. Instead of the direct fix, we isolated it on its own VLAN with strict ACLs and additional monitoring — reducing risk since the ideal control wasn't available."
Memory trick
"Can Mice Operate Phones?" — Categories: Managerial, Operational, Physical (plus Technical). For types, remember "Please Don't Detect Corrections Compensating Directions" in order of the security lifecycle: Preventive → Deterrent → Detective → Corrective → Compensating → Directive.