Security controls that include the policies, procedures around the definition of access controls, definitions of information classifications, roles and responsibilities, and anything needed to manage access control from the administrative point of view.

Administrative controls include the following subcategories:

A type of security control aimed at protecting the physical boundaries and ensuring employee safety, usually deployed in layers in accordance with the concept of defense in depth.

Examples include the fence at the entrance of the building, fire alarms, surveillance systems, and security guards.

Physical access controls are usually designed by defining security zones and implementing different kinds of protection, depending on the classification of the assets.

A type of security control consisting of all the logical and technological systems in place to implement and enforce the controls included in the security policy and, in general, dictated by the administrative controls.

A firewall, an intrusion detection system, a remote access server, an identity management system, and encryption are all examples of technical controls.

Security controls that enforce security policy and should prevent incidents from happening.

The only way to bypass a preventive control is to find a flaw in its implementation or logic.

Examples of preventive controls are access lists, passwords, and fences.

Security controls that aim to monitor and detect any unauthorized behavior or hazard.

These types of controls are generally used to alert a failure in other types of controls such as preventive, deterrent, and compensating controls.

Detective controls are very powerful while an attack is taking place, and they are useful in the post-mortem analysis to understand what has happened.

Audit logs, intrusion detection systems, motion detection, and Security Information and Event Management are examples of detective controls.

Security controls used during an incident to correct the problem.

Quarantining an infected computer, sending a guard to block an intruder, and terminating an employee for not having followed the security policy are all examples of corrective controls.