Types of Security Controls

Security controls are sets of safeguards designed to manage and reduce security risks that could compromise an organisation’s people, systems, data, or operations. 

Effective security programmes and standard frameworks rely on multiple layers of controls that work together to reduce risk and maintain confidentiality, integrity, availability, and resilience.

For example, the ISO 27001 security controls are grouped into four main themes: organizational, people, physical, and technological. Organizations use these controls to treat security risks identified during their assessment and document them in a Statement of Applicability (SoA).

Modern organisations face threats ranging from phishing and ransomware to insider misuse, cloud misconfiguration, physical intrusion, and supply-chain compromise. No single control can address all risks. We therefore implement a balanced control framework that combines governance, technology, physical protection, monitoring, and recovery capabilities to cover the entire set of threats.

Key Types of Security Controls at a Glance

‍

Administrative Security Controls

Administrative controls establish the rules, responsibilities, and procedures that govern security behaviour across the organisation. They are often the foundation of an information security management system.

Core Administrative Controls

• Information security policies
• Acceptable use policies
• Access control policies
• Password and authentication standards
• Security awareness training
• Role-based responsibilities
• Vendor and third-party risk management
• Background screening
• Incident response procedures
• Change management
• Risk assessments and audits

Practical Example

A financial services firm introduces mandatory annual security awareness training, phishing simulations, and a formal access review process every quarter. These measures reduce credential theft risk and help ensure that only authorised staff retain access to sensitive systems.

Implementation Guidance

• Maintain executive-approved policies.
• Review policies at least annually.
• Link training completion to HR records.
• Conduct periodic access recertification.
• Document exceptions and approvals.

Administrative controls are particularly effective against social engineering, insider threats, and process failures.

Technical Security Controls

Technical controls use hardware, software, and configuration settings to enforce security requirements on systems and networks.

Essential Technical Controls

• Multi-factor authentication (MFA)
• Firewalls and web application firewalls (WAF)
• Endpoint detection and response (EDR)
• Antivirus and anti-malware
• Intrusion detection and prevention systems (IDS/IPS)
• Security information and event management (SIEM)
• Encryption at rest and in transit
• Data loss prevention (DLP)
• Network segmentation
• Privileged access management (PAM)
• Secure configuration baselines
• Vulnerability scanning and patch management
• Email security gateways

Real-World Example

An organisation enables MFA for all remote access, deploys EDR across endpoints, and segments finance systems from the general corporate network. When a phishing email compromises a user account, MFA blocks remote access and segmentation prevents lateral movement.

Best Practices

• Enforce MFA for privileged and remote access.
• Patch critical vulnerabilities within defined service levels.
• Disable unused services and ports.
• Centralise logging for security monitoring.
• Test security configurations regularly.

Technical controls provide scalable, measurable protection and are central to modern cybersecurity operations.

Physical Security Controls

Physical controls protect facilities, equipment, and personnel from unauthorised physical access, theft, damage, or disruption.

Common Physical Controls

• Locks and access control systems
• Security guards
• CCTV and video surveillance
• Visitor management systems
• Badge readers and turnstiles
• Fences, gates, and barriers
• Secure server rooms
• Environmental controls (fire suppression, temperature monitoring)
• Asset tagging
• Secure disposal bins and shredders

Practical Example

A data centre uses biometric access control, 24/7 CCTV monitoring, mantraps, and escorted visitor procedures. These measures reduce the likelihood of unauthorised entry and tampering with critical infrastructure.

Operational Guidance

• Restrict access to sensitive areas on a need-to-enter basis.
• Review physical access logs regularly.
• Test alarms and surveillance systems periodically.
• Secure backup media in controlled locations.

Physical security remains essential even in cloud-first organisations because endpoints, offices, and networking equipment still require protection.

Functional Categories of Security Controls

Security controls can also be classified by the function they perform during the lifecycle of an attack or incident.

Preventive Controls

Preventive controls aim to stop an incident before it occurs.

Examples

• MFA
• Strong passwords
• Network segmentation
• Secure coding practices
• Patch management
• Encryption
• Least privilege access

These controls reduce the attack surface and block common attack paths.

Detective Controls

Detective controls identify suspicious activity or security events.

Examples

• SIEM alerts
• IDS
• Log monitoring
• File integrity monitoring
• Security audits
• User behaviour analytics

Rapid detection shortens attacker dwell time and improves response effectiveness.

Corrective Controls

Corrective controls remove threats and restore systems after detection.

Examples

• Malware eradication
• Patching exploited vulnerabilities
• Account resets
• Configuration remediation
• Reimaging compromised devices

Corrective actions should be documented and tracked to closure.

Deterrent Controls

Deterrent controls discourage malicious behaviour.

Examples

• Security warning banners
• Visible CCTV cameras
• Security patrols
• Disciplinary policies
• Legal notices

Deterrence is especially useful for insider threat reduction.

Recovery Controls

Recovery controls restore services and data after disruption.

Examples

• Backups
• Disaster recovery sites
• High availability clusters
• Cloud failover
• Business continuity plans

Recovery capability determines how quickly operations can resume after an incident.

Compensating Controls

Compensating controls provide alternative protection when a primary control is not feasible.

Example

A legacy application cannot support MFA. The organisation restricts network access, implements jump-host access, enables continuous session monitoring, and performs daily access reviews until the application can be replaced.

Mapping Controls to Common Threats

‍

Layered Security: How Controls Work Together

Strong security depends on defence in depth. Consider a remote employee accessing a finance application:

1. Administrative: Access approved by manager and role policy.
2. Technical: VPN with MFA and device compliance checks.
3. Detective: SIEM monitors login behaviour.
4. Corrective: Suspicious session is terminated automatically.
5. Recovery: Backups protect financial data.
6. Physical: Company laptop uses full-disk encryption and cable locks.

If one control fails, additional controls continue to provide protection.

Security Controls in Major Frameworks

ISO/IEC 27001

ISO 27001 groups controls into organisational, people, physical, and technological categories. Examples include access control, cryptography, supplier management, logging, and physical security.

NIST Cybersecurity Framework (CSF)

NIST CSF organises controls into Identify, Protect, Detect, Respond, and Recover, aligning closely with the functional categories above.

CIS Critical Security Controls

The CIS Controls prioritise practical safeguards such as asset inventory, vulnerability management, secure configuration, account management, logging, and incident response.

Aligning controls with recognised frameworks improves consistency, auditability, and regulatory compliance.

Selecting the Right Security Controls

We select controls through a risk-based process.

Step 1: Identify Assets

• Sensitive data
• Critical applications
• Cloud services
• Endpoints
• Facilities

Step 2: Assess Threats and Vulnerabilities

• External attackers
• Insider threats
• Third parties
• Misconfigurations
• Physical risks

Step 3: Determine Risk

Evaluate likelihood and business impact.

Step 4: Choose Controls

Select controls that reduce risk to an acceptable level.

Step 5: Measure Effectiveness

Track metrics such as:

• MFA adoption rate
• Patch compliance
• Mean time to detect (MTTD)
• Mean time to respond (MTTR)
• Backup recovery success rate
• Phishing simulation failure rate

Common Mistakes When Implementing Security Controls

• Relying solely on technical tools
• Excessive privileged access
• Infrequent policy reviews
• Unmonitored logs
• Untested backups
• Ignoring physical security
• Poor asset inventory
• Inadequate vendor oversight
• Lack of user training
• No control effectiveness metrics

Avoiding these weaknesses significantly improves security maturity.

Security Controls for Cloud Environments

Cloud adoption changes the control landscape.

Recommended Cloud Controls

• Identity and access management (IAM)
• MFA for cloud administrators
• Cloud security posture management (CSPM)
• Encryption using managed keys
• Logging and cloud-native SIEM integration
• Network security groups and segmentation
• Infrastructure-as-code security scanning
• Continuous compliance monitoring

Shared responsibility models make configuration management and identity security especially important.

Measuring Control Effectiveness

Controls should be tested continuously rather than assumed effective.

‍

Continual monitoring of the total attack surface using tools like VerifiedThreat, audits, penetration testing, and tabletop exercises validate that controls operate as intended.

Conclusion

Effective cybersecurity depends on a balanced set of security controls that address governance, technology, physical protection, detection, response, and recovery. Administrative controls shape secure behaviour, technical controls enforce protection, and physical controls secure facilities and assets. Preventive, detective, corrective, deterrent, recovery, and compensating controls then work together to create defence in depth.

Organisations that align controls to business risk, recognised frameworks, and measurable outcomes achieve stronger resilience against cyber threats, operational disruptions, and compliance failures.

‍