"Security control" is one of the most-used and least-precisely-understood terms in both cybersecurity and compliance. A control is simply a safeguard -- a specific measure put in place to reduce risk, by preventing a threat, detecting it, correcting its effects, deterring it, or compensating for another control that cannot be fully implemented. Understanding the different categories, and matching the right category to the right risk, is what separates a genuinely effective control framework from a checklist copied from a template.
Control Categories, by Function
- Preventive controls stop an incident before it happens. Examples: firewalls blocking unauthorized traffic, multi-factor authentication blocking credential-only compromise, network segmentation blocking lateral movement. Preventive controls are the highest-value category when they work, because they eliminate the cost and disruption of an incident entirely rather than just responding to one -- but no environment can rely on prevention alone, because no preventive control is ever 100% effective against every technique.
- Detective controls identify that something has already happened, or is happening right now. Examples: SIEM correlation alerts, intrusion detection systems, file integrity monitoring, security awareness reporting from employees who notice something unusual. Detective controls are what makes the difference between a threat that dwells undetected for months and one that is caught quickly enough to limit damage.
- Corrective controls reduce the impact after an incident has occurred and restore normal operation. Examples: backup and recovery procedures, incident response playbooks, patch management closing an exploited vulnerability after the fact.
- Deterrent controls discourage an attacker from attempting an action in the first place, without technically preventing it outright. Examples: visible security cameras, warning banners on login screens, a publicly known policy of prosecuting unauthorized access. Deterrents work primarily against opportunistic or risk-averse actors and are far less effective against a determined, targeted adversary.
- Compensating controls provide an alternative safeguard when the originally intended control cannot be implemented as designed -- for example, a legacy industrial control system that cannot support modern endpoint agents might be protected instead by strict network isolation and enhanced monitoring around it. A compensating control is only legitimate when it genuinely achieves an equivalent risk reduction to the control it is standing in for, not simply whatever was easiest to implement.
Control Types, by Nature
Independent of function, every control also has a nature -- how it is actually implemented:
- Administrative (managerial) controls -- policies, standards, procedures, and training. An access control policy defining who is authorized to request privileged access is an administrative control, distinct from the technical system that actually enforces it.
- Technical (logical) controls -- implemented through technology: firewalls, encryption, access control lists, endpoint detection software.
- Physical controls -- protect the physical environment: badge access to a facility, locked server rooms, environmental controls protecting equipment, physical security guards.
Most well-designed protections combine several types together. Access control, for example, typically needs an administrative policy (who is allowed to request access and under what conditions), a technical enforcement mechanism (the identity system that actually grants or denies it), and sometimes a physical layer too (badge access controlling who can even reach the console in the first place).
Common Controls: Descriptions, Advantages, and Compliance Mapping
Multi-Factor Authentication (MFA)
Description: Requires a second independent factor beyond a password to authenticate -- something the user has (a token or authenticator app) or something the user is (biometrics).
Advantage: Neutralizes the single most common initial-access technique -- stolen or guessed credentials alone are no longer sufficient to log in.
Compliance mapping: Referenced directly in ISO 27001 Annex A access control requirements, a core NIST CSF Protect function expectation, and increasingly an explicit requirement in sector-specific frameworks and cyber-insurance underwriting questionnaires.
Network Segmentation
Description: Dividing a network into isolated zones based on trust level and function, with controlled, monitored conduits between them.
Advantage: Contains the blast radius of a compromise -- an attacker who breaches one segment cannot automatically reach every other system on the network.
Compliance mapping: A central requirement of IEC 62443's zone-and-conduit model for industrial environments, and a standard recommendation across ISO 27001 and NIST CSF network security expectations.
Endpoint Detection and Response (EDR)
Description: Continuous monitoring software on endpoints that detects suspicious process behavior, file activity, and network connections, with the ability to isolate an endpoint automatically or on analyst command.
Advantage: Provides visibility and response capability at the endpoint level, where traditional signature-based antivirus alone increasingly misses modern, behavior-based attack techniques.
Compliance mapping: Supports NIST CSF's Detect and Respond functions directly, and is a common evidentiary control referenced in ISO 27001 operational security requirements.
Patch and Vulnerability Management
Description: A structured, ongoing process of identifying vulnerabilities, prioritizing them by real exploitability and asset criticality (not severity score alone), and applying fixes within a defined timeframe.
Advantage: Closes the specific technical weaknesses attackers most commonly and reliably exploit, before they can be used.
Compliance mapping: An explicit requirement across essentially every major framework -- ISO 27001 Annex A, NIST CSF Protect, IEC 62443, and PCI DSS all require a documented, operating patch management process, not just occasional ad-hoc updates.
Least Privilege and Role-Based Access Control (RBAC)
Description: Users and service accounts are granted only the specific access required for their role, no more, with access defined by role rather than assigned individually case by case.
Advantage: Limits what any single compromised account can actually do, directly reducing both the likelihood and the impact of privilege misuse or credential compromise.
Compliance mapping: A foundational requirement of ISO 27001 Annex A access control clauses and a core NIST CSF Protect expectation.
Encryption (At Rest and In Transit)
Description: Rendering data unreadable without the correct decryption key, both while stored and while moving across a network.
Advantage: Protects data confidentiality even if storage or network traffic is intercepted or accessed without authorization.
Compliance mapping: Explicitly required by PCI DSS for cardholder data, a standard ISO 27001 Annex A cryptography control, and frequently mandated by data protection regulation for personal data specifically.
Logging and Monitoring
Description: Centralized, retained, and actively reviewed logs of security-relevant activity across the environment -- the subject of this Knowledge Center's companion article on logging systems.
Advantage: Without it, neither detection nor forensic investigation after an incident is possible in any reliable way.
Compliance mapping: A named requirement across ISO 27001 Annex A, NIST CSF's Detect function, IEC 62443, and PCI DSS, each of which specifies minimum logging scope and retention.
Backup and Recovery
Description: Regular, tested backups of critical systems and data, stored separately enough from production (including offline or immutable copies) that they survive a ransomware event targeting the primary environment.
Advantage: Converts a potentially catastrophic, business-ending event into a recoverable incident with a bounded, known recovery time.
Compliance mapping: Required under ISO 27001 Annex A operational resilience clauses and a central element of NIST CSF's Recover function.
Security Awareness Training
Description: Structured, recurring education for employees on recognizing phishing, social engineering, and safe handling of sensitive information and systems.
Advantage: Addresses the human element directly -- a significant share of real breaches begin with a person, not a technical vulnerability, and no purely technical control fully compensates for that.
Compliance mapping: Explicitly required under ISO 27001 Annex A and referenced in NIST CSF's Govern function as part of building organizational risk culture.
Third-Party and Vendor Access Control
Description: Formal governance of external access -- replacing standing vendor credentials with time-boxed, ticket-linked, and logged access requests, and isolating vendor-facing systems into their own network zone.
Advantage: Closes one of the most consistently exploited real-world attack paths -- third-party access that was granted once, never reviewed again, and quietly expanded over time.
Compliance mapping: A dedicated area of focus in IEC 62443 (conduit and remote access requirements) and covered under ISO 27001 Annex A supplier relationship controls.
Control Effectiveness: Why "It Exists" Is Not Enough
A control that is documented in an architecture diagram but has never actually been tested is a hypothesis, not a working safeguard. Real control effectiveness requires evidence -- a penetration test confirming segmentation actually blocks lateral movement, an access review confirming least privilege is genuinely enforced and not just written down, a tested (not merely documented) backup restoration. Auditors, insurers, and, more importantly, real attackers, do not care what a policy document claims; they respond to what is actually enforced and actually works when tested.
Building a Control Framework That Actually Holds Together
The most effective control programs work backward from real risk, not forward from a generic checklist: identify the specific risks that matter most in this environment, select controls genuinely proportionate to those risks (across the preventive, detective, corrective, deterrent, and compensating categories, not preventive controls alone), implement each one with clear ownership, and then map the resulting set of controls onto whichever compliance frameworks are relevant -- so that compliance becomes a natural byproduct of a real risk-driven security program, rather than the program being reverse-engineered from a compliance checklist with little connection to the organization's actual risk profile.