Preventive, Detective & Corrective Controls

They are separated by when they act. A preventive control stops an incident before it happens — a firewall blocking traffic, a lock on a door. A detective control notices an incident while or after it happens — a SIEM alert, CCTV footage, a log review. A corrective control restores things afterwards — restoring from backup, applying a patch, an incident response team. The same threat usually needs all three, because prevention eventually fails.

Technical: system backups and recovery, automated patch management, quarantining an infected host, failover to a standby system, intrusion prevention that actively blocks. Physical: fire suppression, backup power such as UPS or generators, emergency response procedures. Administrative: incident response teams, business continuity plans, policy updates and lessons-learned reviews after an incident.

A compensating control is a substitute used when the control you would normally apply is not feasible, and it must give comparable protection rather than simply being easier. A common example is a legacy system that cannot support multi-factor authentication: isolating it on its own network segment with strict access logging compensates for the missing MFA. Auditors generally expect the reasoning to be documented, not just the substitute.

A deterrent control discourages someone from attempting an attack without physically preventing it — warning signage, visible cameras, a login banner stating that activity is monitored. A directive control instructs people what they should do and relies on compliance rather than enforcement — acceptable use policies, documented procedures, mandatory training. Both appear in CompTIA Security+ material alongside preventive, detective and corrective.

Both, and this is the distinction exam questions are usually testing. Every control has a type, meaning how it is implemented — physical, technical or administrative — and a function, meaning what it does — preventive, detective or corrective. A firewall is a technical control with a preventive function. CCTV is a physical control with a detective function. An incident response team is an administrative control with a corrective function. If a question seems to offer two right answers, check whether it is asking about type or function.

There is no fixed number, and aiming for one per cell misses the point. The matrix is a gap-finding tool: work through all nine cells and look for ones that are empty or thin for the risks you actually face. Defence in depth means covering an important function with more than one type — preventing intrusion technically with a firewall, physically with door locks, and administratively with training — so that one failure does not leave the function uncovered.