How security controls are classified by form and function, and how layered safeguards reduce risk.
Security controls can be described by form and function. A single safeguard commonly has both classifications.
| Form | Examples |
|---|---|
| Technical | MFA, encryption, EDR, IDS/IPS, ACLs |
| Managerial | Policies, standards, governance, risk decisions |
| Operational | Playbooks, log review, training, job rotation |
| Physical | Locks, guards, barriers, cameras |
| Function | Purpose |
|---|---|
| Preventive | Stop or reduce the likelihood of an event |
| Detective | Identify that an event occurred or is occurring |
| Corrective | Restore service or correct a state after an event |
| Deterrent | Discourage undesirable behavior |
| Compensating | Reduce risk when a preferred control is temporarily unavailable |
| Directive | State required behavior or process |
A badge reader is a physical, generally preventive control. A log-review process is operational and detective. When a legacy system cannot yet be patched, segmentation and additional monitoring may be compensating controls until remediation is available.
Layered controls are stronger than reliance on a single product: policy can require MFA, technical controls enforce it, alerts detect failures, and recovery procedures correct compromised access.