Last updated:
CISSP decision trap
What are the types of security controls?
Direct answer
Security controls are grouped two ways. By what they do: preventive controls stop an incident, detective controls find one, and corrective controls limit and fix the damage, with deterrent, recovery, compensating and directive controls completing the usual list. By how they are put in place: administrative, technical or physical. Every control has a category and at least one type: a firewall rule is a technical, preventive control.
The seven control types, by what they do
| Type | What it does, with an example |
|---|---|
| Preventive | Stops an incident before it happens, such as a firewall rule or a locked door |
| Detective | Finds and records an incident, such as an audit log or an intrusion detection alert |
| Corrective | Limits the damage and fixes the cause, such as patching an exploited flaw or quarantining malware |
| Deterrent | Discourages an attempt without stopping it, such as a warning banner or a visible camera |
| Recovery | Restores normal operations, such as restoring from backup or failing over to another site |
| Compensating | Gives comparable protection in place of a required control, such as extra review where separation of duties cannot be met |
| Directive | Tells people what they must or must not do, such as a policy, a standard or an acceptable use notice |
One control, a category and a type
A data centre puts a guard at the entrance, records every visitor in a log, posts a sign saying the area is monitored, and requires staff to acknowledge a security policy before they get a badge.
The guard is a physical control that prevents entry and deters attempts. The visitor log is a procedure, so administrative, and detective; the sign is physical and deterrent, and the policy acknowledgment is administrative and directive. Name both the category and the type before choosing an answer.
By what it does: the seven types
The CISSP outline names preventive, detection and corrective controls; study material adds deterrent, recovery, compensating and directive controls.
Objective 1.9 of the 2024 outline lists applicable types of controls (e.g., preventive, detection, corrective), and the outline effective 15 April 2027 uses the same words. The other four types come from study guides and standard practice rather than the outline. The table above gives all seven. Read the question for the clue: how to stop something points to preventive, how you would know to detective, damage already done to corrective or recovery, and an attacker's choice to deterrent.
By how it is put in place: administrative, technical and physical
Administrative controls are policies, procedures, training and supervision; technical controls work through hardware or software; physical controls protect facilities and equipment.
Technical controls are also called logical controls. Exam questions usually expect one category per control and one or more types, so a firewall rule is technical and preventive, and a background check is administrative and preventive. NIST defines security controls as the safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information.
Earlier NIST guidance grouped controls as management, operational, and technical, and the wording still appears in NIST's glossary, for example in SP 800-137's definition of compensating security controls. Management controls are close to administrative ones; operational controls are those people carry out day to day, including physical and environmental protection.
Compensating controls
A compensating control gives equivalent or comparable protection when the control a baseline calls for cannot be used.
NIST SP 800-37 Rev. 2, quoted in NIST's glossary, defines compensating controls as the security and privacy controls implemented in lieu of the controls in the baselines described in NIST Special Publication 800-53 that provide equivalent or comparable protection for a system or organization.
In NIST's usage, a compensating control stands in for a required control that cannot be met; adding a layer to a control already in place is usually called defence in depth. Some study guides use the term more broadly, so read what the question says the control replaces. For example, when a small team cannot separate who requests and who approves payments, a manager reviewing every payment each week is an administrative control that compensates for the missing separation of duties.
The mistakes that make a wrong type look right
Most wrong answers name the technology or mix up two neighbouring types.
- Naming the technology instead of the purpose: in most exam scenarios a camera is detective when someone reviews the footage and deterrent when it is visible; on its own it physically stops nothing.
- Calling a deterrent preventive: a deterrent discourages an attempt; a preventive control stops one that is made.
- Mixing corrective and recovery: corrective controls fix the immediate problem; recovery controls, an extension of corrective ones, bring wider operations back, so restoring a whole service from backup is usually recovery.
- Treating a policy as technical: a policy is administrative and directive, even when a tool later enforces it.
- Calling any extra control compensating: in the usual exam sense it stands in for a required control that cannot be met.
Check the rule on a changed scenario
Change what the control does to the incident, and check whether its type changes.
- An account locks after five failed sign-ins: technical and preventive.
- A security monitoring system alerts on a burst of failed sign-ins: technical and detective.
- After ransomware, the team restores files from backup: technical and recovery.
- A legacy system cannot support multifactor authentication, so access is allowed only through a jump host that requires multifactor authentication and records sessions: technical and compensating.
Sources and fact check
Source checked: 2026-10-29
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What are the types of security controls?
Security controls are grouped two ways. By what they do: preventive controls stop an incident, detective controls find one, and corrective controls limit and fix the damage, with deterrent, recovery, compensating and directive controls completing the usual list. By how they are put in place: administrative, technical or physical. Every control has a category and at least one type: a firewall rule is a technical, preventive control.
Is a security guard preventive or deterrent?
It depends on what the guard does in the scenario. A visible guard deters attempts, a guard who checks badges and refuses entry prevents them, and a guard watching camera feeds detects them. All three are physical controls.
What is the difference between corrective and recovery controls?
Corrective controls limit the damage from an incident and fix its cause, such as removing malware or patching the flaw that let it in. Recovery controls bring normal operations back afterwards, such as restoring data from backup.
What is a compensating control?
A control used in place of one that a baseline or requirement calls for, giving equivalent or comparable protection. NIST SP 800-37 Rev. 2 defines compensating controls as implemented in lieu of the baseline controls described in NIST Special Publication 800-53.
Are administrative controls the same as directive controls?
No. Administrative is a category, how the control is put in place; directive is a type, what it does. Many administrative controls are directive, such as a policy, but a background check is administrative and preventive.
