Security Control Types Explained: Categories and Functions for Security+

Security controls are classified two ways at once, and SY0-701 tests both. A control has a category — what kind of thing it is — and a function — what it does about a threat. Every control has one of each, and exam questions frequently ask for both about the same control.

The four categories

Category	What it is	Examples
Technical	Implemented in technology	Firewall, encryption, MFA, antivirus
Managerial	Administrative decisions and oversight	Risk assessments, policies, security planning
Operational	Carried out by people, day to day	Awareness training, guards, change management
Physical	Tangible barriers and protections	Fences, locks, bollards, access control vestibules

The line candidates blur is managerial versus operational. Managerial is planning and governance — writing the policy, running the risk assessment. Operational is humans executing — delivering the training, performing the backup, staffing the desk. Writing the incident response plan is managerial; running the incident is operational.

The six functions

Preventive stops an incident before it happens. Firewall rules, access control lists, door locks, input validation.

Deterrent discourages an attacker from trying. Warning signage, visible cameras, published sanctions. The distinction from preventive is that a deterrent works on the attacker's decision, not on their capability. A sign saying premises are monitored deters; it prevents nothing.

Detective identifies that something happened. Logs, IDS, SIEM alerts, CCTV review, audits.

Corrective fixes things after the fact. Restoring from backup, patching the exploited vulnerability, removing malware.

Compensating substitutes for a primary control that cannot be implemented. Discussed below, because it is the one most often tested.

Directive instructs people toward the desired behaviour. Policies, procedures, acceptable use agreements.

Compensating controls

A compensating control is used when the preferred control is not feasible — a legacy system that cannot support multifactor authentication, a medical device that cannot be patched, a process that a regulation requires but the technology will not allow.

It must provide comparable protection, not merely something in the same area. Segmenting an unpatchable device onto an isolated VLAN with strict access control and heightened monitoring is a compensating control for the missing patch. Writing a memo acknowledging the risk is not a control at all.

Exam signal: if a scenario says a required control cannot be implemented and asks what to do, the answer is a compensating control, not an exception.

One control, both classifications

Because the schemes are independent, a single control gets labelled twice.

Control	Category	Function
Firewall	Technical	Preventive
Security camera	Physical	Detective and deterrent
Awareness training	Operational	Preventive
Acceptable use policy	Managerial	Directive
Backups	Technical	Corrective
SIEM alerting	Technical	Detective
Bollards	Physical	Preventive
Warning signage	Physical	Deterrent

Cameras are worth pausing on, because they appear constantly. A visible camera deters. Recorded footage reviewed afterwards detects. Neither prevents anything — a camera does not stop a person walking through a door.

Defence in depth

The reason multiple categories and functions exist. No single control holds, so you layer: a deterrent at the perimeter, preventive controls at the boundary and on the host, detective controls watching throughout, and corrective controls ready for when something gets through.

Related terms the exam pairs with this: defence in depth is layering controls; control diversity is using different types so one flaw does not defeat every layer; vendor diversity extends that to different suppliers.

Controls and risk

Controls are one of four responses to risk. You can mitigate by applying controls, transfer by insuring or outsourcing, accept the risk with documented sign-off from the owner, or avoid it by not doing the activity. What remains after controls are applied is residual risk, and accepting that is the data or system owner's decision.

What to remember

Category is what the control is — technical, managerial, operational, physical. Function is what it does — preventive, deterrent, detective, corrective, compensating, directive. Every control has one of each. Deterrents change the attacker's mind; preventives change what is possible. Compensating controls substitute for an infeasible primary control and must give comparable protection.

Related reading: Access control vestibules · Zero trust and threat scope reduction · SIEM