Security Controls Matrix

Every control has a TYPE (how it's implemented) and a FUNCTION (what it does). Here's the full 3 × 3.

Preventive

Stop threats

Detective

Identify incidents

Corrective

Fix & recover

Control type	Preventive	Detective	Corrective
Physical	Door locks & key cards Security guards Fences & barriers Biometric scanners Mantrap doors	CCTV cameras Motion sensors Badge reader logs Glass break detectors Visitor management systems	Emergency response procedures Backup power (UPS/generators) Fire suppression systems Evacuation plans Physical asset recovery
Technical	Firewalls Antivirus software Multi-factor authentication Data encryption Input validation Access control lists	Intrusion Detection Systems (IDS) SIEM systems Log monitoring File integrity monitoring Network traffic analysis Vulnerability scanners	Intrusion Prevention Systems (IPS) Automated patch management System backups & recovery Quarantine systems Failover systems Incident response tools
Administrative	Security awareness training Background checks Separation of duties Acceptable use policies Password policies Security procedures	Security audits Log reviews Performance monitoring Compliance assessments Peer reviews Whistleblower programs	Incident response teams Business continuity plans Disciplinary actions Policy updates Lessons-learned programs Process improvements

Every control has both a type (how it's implemented) and a function (what it does). For example:

A firewall is a Technical control with a Preventive function.
CCTV cameras are Physical controls with a Detective function.
Incident response teams are Administrative controls with a Corrective function.