Think of security controls as the defensive layers of an organization. To make them easy to understand and remember for the exam, CompTIA breaks them down into two main dimensions: Categories (how the control is implemented) and Control Types (what the control actually accomplishes).
Here is the breakdown with clear, real-world examples.
1. Control Categories (The “How”)
Categories define how a security measure is constructed or enforced. Every single security control falls into one of these four buckets.
Technical (Logical) Controls
These are security measures implemented through hardware, software, or firmware. If it involves configuration, code, or a digital system, it’s technical.
- Example 1: Firewalls and Access-Control Lists (ACLs) block unauthorized network traffic.
- Example 2: Requiring Multi-Factor Authentication (MFA) or biometric scans to log into a server.
- Example 3: Hardening a network switch by disabling unused ports.
Managerial (Administrative) Controls
These are controls focused on governance, risk, and the human element. They are typically written documents, strategic decisions, or business processes that management creates to guide behavior and ensure compliance.
- Example 1: An Acceptable Use Policy (AUP) that employees must sign, detailing what they may and may not do on company computers.
- Example 2: Regular risk assessments conducted to identify vulnerabilities in the organization’s infrastructure.
- Example 3: Onboarding security awareness training for new hires.
Operational Controls
These are the day-to-day practices and procedures that humans carry out to maintain security. While managerial controls define the policy, operational controls are the actual execution of security tasks.
- Example 1: An administrator routinely checking firewall logs for suspicious activity.
- Example 2: Performing weekly data backups and storing them offsite.
- Example 3: Conducting user account reviews to ensure former employees have had their access revoked.
Physical Controls
These are tangible controls that you can physically touch. They protect physical spaces, assets, and personnel from real-world access or environmental hazards.
- Example 1: Locked doors, server cages, and perimeter fences.
- Example 2: Security guards stationed at an entrance or CCTV cameras monitoring a hallway.
- Example 3: Fire suppression systems (like FM-200 gas or sprinklers) inside a data center.
2. Control Types (The “What”)
Control types describe the function or goal of the security measure. When looking at a control, ask yourself: “What is this trying to achieve in the timeline of a security event?”
Preventive Controls
These act before an incident happens to proactively block unauthorized activity or prevent a vulnerability from being exploited.
- Example: A firewall blocking malicious IP addresses. It stops the attack from entering the network entirely.
- Example: A physical padlock on a server rack.
Deterrent Controls
These are designed to discourage potential attackers or rule-breakers from taking action by warning them of the consequences. They don’t physically or digitally stop an attack, but they make the attacker think twice.
- Example: A “No Trespassing” sign or a highly visible security camera.
- Example: A login banner stating, “All activity on this system is monitored and prosecuted.”
Detective Controls
These operate during or after an attack to identify, log, and alert security teams to unusual or unauthorized activity. They do not stop the attack; they just shine a light on it.
- Example: An Intrusion Detection System (IDS) alerting an admin to an active network scan.
- Example: Reviewing security camera footage or system audit logs after a breach.
Corrective Controls
These are deployed after an incident to reverse the damage, restore systems to normal, and mitigate the impact.
- Example: Restoring a database from a clean backup after a ransomware attack.
- Example: Using an antivirus tool to quarantine or delete a detected malware file.
Compensating (Alternative) Controls
These are temporary or alternative measures put in place when the primary, ideal control is too expensive, impossible to implement, or temporarily broken. It provides a similar level of defense using a different method.
- Example: A legacy server running an old operating system cannot support modern MFA (the ideal technical control). As a compensating control, you isolate that server onto a strictly firewalled, dedicated VLAN with no internet access.
- Example: An electronic badge reader on a door fails. A security guard is stationed at the door to manually check IDs until it is fixed.
Directive Controls
These are rules, mandates, or instructions that order specific compliance and behavior. They rely on human compliance and are usually driven by legal, regulatory, or policy requirements.
- Example: A policy requiring all employees to wear their ID badges visibly at all times.
- Example: Signs pointing to designated emergency exits.
Quick Exam Tip: The Matrix Effect
On the Security+ exam, CompTIA loves to ask you to classify a single item by both its category and its type. They overlap cleanly.
Look at how these intersect:
| Security Measure | Category (How) | Type (What) |
| A Security Guard | Physical | Deterrent / Preventive |
| Firewall Configuration | Technical | Preventive |
| System Audit Logs | Technical | Detective |
| Data Backup Restoration | Operational | Corrective |
| An Acceptable Use Policy | Managerial | Directive |