Implementation categories
- Technical: implemented through systems, software, devices, and configurations
- Managerial: governance, planning, oversight, risk, and policy decisions
- Operational: procedures and activities carried out by people and teams
- Physical: protection of facilities, equipment, and the physical environment
Functional types
- Preventive controls attempt to stop an event
- Detective controls identify events or conditions
- Corrective controls reduce damage or restore operation
- Deterrent controls discourage unwanted behavior
- Compensating controls provide an alternative when a preferred control is not feasible
- Directive controls state required behavior or action
Why classification helps
Classification makes it easier to identify gaps. A program with only preventive technology may still lack detection, recovery, governance, or physical safeguards.
Context matters
The same control may serve more than one function depending on how it is implemented and used. The classification should support reasoning, not replace it.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: