Security Controls: Technical, Administrative, and Physical Types

A security control is any safeguard or countermeasure that reduces risk to an asset. Controls protect confidentiality, integrity, and availability by stopping bad things from happening, noticing them when they do, or limiting the damage afterward. Everything from a firewall rule to a locked door to an employee handbook counts as a control, which is why classification matters: with thousands of possible safeguards, security professionals need a shared vocabulary for organizing them.

The CC exam uses two independent classification schemes, and keeping them separate is the key to this whole sub-domain. The first scheme is control type, which describes how the control is implemented. There are exactly three types: technical controls, also called logical controls, implemented through hardware and software; administrative controls, also called managerial controls, implemented through people, policies, and process; and physical controls, implemented through real-world barriers and devices. The second scheme is control function, which describes what the control is meant to accomplish: preventive, detective, corrective, deterrent, or compensating.

Every control has a type, and every control serves at least one function. A fence is physical by type and both deterrent and preventive by function. Security awareness training is administrative by type and preventive by function. The exam loves to test whether you can hold both classifications in mind at once, so this lesson covers the three types in depth first, then the five functions at the recognition level the exam expects.

Technical controls, also called logical controls, are safeguards implemented and enforced by technology: hardware, software, and firmware. Once configured, they operate automatically without a human making a decision each time. If a system, not a person, is doing the enforcing, you are looking at a technical control.

The examples you must recognize on sight are:

• Firewalls, which filter network traffic according to configured rules.
• Encryption, which protects the confidentiality of data at rest and in transit.
• Access control lists, or ACLs, which define which users or systems may access a resource and what they may do with it.
• Intrusion detection and intrusion prevention systems, IDS and IPS, which monitor networks and hosts for malicious activity and, in the case of an IPS, block it.
• Multifactor authentication, or MFA, which requires more than one type of evidence before granting access.
• Antivirus and anti-malware software, which detect and quarantine malicious code.

A common point of confusion is that technical controls still originate from human decisions: someone writes the firewall policy, someone chooses the encryption standard. That does not make them administrative. The classification follows the enforcement mechanism, not the author. A password requirement written in a document is administrative; the login system that actually rejects a short password is technical. When an exam question describes software or hardware doing the work of enforcement, choose technical, regardless of who designed the rule.

Administrative controls, also called managerial controls, are safeguards implemented through people, processes, and management direction rather than through technology or physical barriers. They shape how people behave: what they are allowed to do, what they know, and how the organization makes security decisions. If the control exists on paper or in a process and relies on humans to carry it out, it is administrative.

The examples to recognize are:

• Security policies and the standards and procedures that support them.
• Security awareness training, which teaches employees to recognize threats such as phishing.
• Background checks performed before hiring or granting sensitive access.
• Risk assessments, which identify and prioritize the risks the organization faces.
• Separation of duties and job rotation, which prevent any one person from controlling a sensitive process end to end.
• Incident response plans and business continuity plans.

Administrative controls are the easiest type to underestimate and the hardest to do well. A brilliant firewall cannot save an organization whose employees click every phishing link, and no technology substitutes for hiring trustworthy people and defining who may approve what. On the exam, trigger words for administrative controls include policy, procedure, training, awareness, background check, hiring practice, and risk assessment. If the scenario describes a rule, a plan, or a people-focused practice with no device enforcing it, classify it as administrative.

Physical controls are safeguards that protect facilities, equipment, and people in the real, tangible world. They control who can physically reach an asset and what happens when someone tries. If you can touch it, walk through it, or be stopped at it, it is a physical control.

The examples to recognize are:

• Locks on doors, cabinets, and server racks.
• Security guards who verify identity and watch for intruders.
• Fences and gates that establish a perimeter around a site.
• Badges and badge readers that admit only authorized personnel. The badge system has electronic parts, but its job is controlling physical entry, so the exam treats it as a physical control.
• CCTV cameras that record activity for monitoring and later review.
• Mantraps, also called access control vestibules: a pair of interlocking doors where the first must close before the second opens, admitting one person at a time and preventing tailgating.
• Lighting, bollards, and environmental protections such as fire suppression.

Physical security matters to cybersecurity because physical access defeats logical protection: an attacker who can steal an unencrypted server does not need to hack it over the network. That is why data centers stack fences, guards, badges, mantraps, and locked racks in sequence. On the exam, any control described as a barrier, a person guarding a place, or a device controlling entry to a space should be classified as physical, even when electronics are involved.

Use this table as your classification reference. The middle column is the test that never fails: ask what actually enforces the control.

Three boundary cases deserve special attention because the exam uses them as distractors. First, a password policy document is administrative, while the login system enforcing password rules is technical: same rule, two controls, two types. Second, a badge reader is physical despite containing electronics, because it governs entry to a space rather than access to data. Third, a security guard is physical, not administrative, even though a guard is a person: the guard is a barrier protecting a place, whereas administrative controls are the rules and processes people follow.

When you meet an unfamiliar control on the exam, do not try to recall a memorized list. Apply the enforcement test: automatic technology means technical, human process and paperwork means administrative, protection of a tangible place means physical. The test resolves nearly every question this sub-domain can ask.

Defense in depth, also called layered security, is the strategy of placing multiple controls of different types between a threat and an asset, so that the failure of any single control does not expose the asset. No control is perfect: firewalls are misconfigured, guards are distracted, employees forget training. Layers ensure that when one safeguard fails, another stands behind it.

Walk through a concrete scenario: protecting a customer database in a small company. At the perimeter of the building, a fence and a badge-controlled entrance stop casual intruders, and CCTV records everyone who approaches: physical controls. The server itself sits in a locked room that only two administrators can enter: another physical layer. On the network, a firewall restricts which systems can reach the database server, the database requires multifactor authentication, an ACL limits each account to the tables it needs, and the data is encrypted at rest: technical controls. Surrounding all of it, the company runs background checks on the administrators, trains every employee to recognize phishing, enforces separation of duties so no single person can both modify and audit records, and maintains an incident response plan: administrative controls.

Now imagine any single layer failing. A phished password is blunted by MFA. A stolen disk is unreadable because of encryption. A malicious insider is limited by separation of duties and recorded by CCTV. That interlocking coverage across all three control types is exactly what defense in depth means, and the exam expects you to recognize both the term and the reasoning behind it.

Control functions classify what a control is meant to accomplish, independent of its type. The CC exam tests these at recognition depth: you need to match each function to its definition and to obvious examples.

The pair most often confused is deterrent versus preventive. A deterrent works on the attacker's mind: a warning sign discourages the attempt but physically stops nothing. A preventive control works regardless of the attacker's decision: a locked door blocks entry whether or not the intruder read the sign. If the control only discourages, it is a deterrent; if it actually blocks, it is preventive.

Compensating controls appear when the ideal control cannot be used. If a medical device runs an operating system that cannot be patched, the organization compensates by isolating it on its own network segment and monitoring it closely. The substitute controls fill the gap left by the missing primary control.

The exam's favorite trick in this sub-domain is asking for type and function together, or presenting one control that carries several functions. The two schemes are independent, so classify twice: first ask how the control is implemented, then ask what it accomplishes.

Work through a few pairings. A CCTV camera is physical by type; by function it is detective, because footage reveals what happened, and its visible presence is also a deterrent. A fence is physical, and it is both a deterrent, discouraging intruders, and preventive, physically blocking them. An IDS is technical and detective: it identifies attacks but does not stop them, which is precisely what separates it from an IPS, which is technical and preventive. Security awareness training is administrative and preventive, because it stops incidents by changing behavior before an attack lands. Restoring a server from backup after ransomware is a corrective action supported by technical means, and the backup schedule mandated in policy is administrative.

Notice what these examples demonstrate: one control, one type, but often more than one function. Type is fixed by the implementation; function depends on the role the control plays in the scenario. When a question asks which function a control serves, read the scenario for what the control actually did: discouraged, blocked, discovered, or repaired. When it asks for the type, ignore the outcome entirely and look only at the mechanism. Candidates who blur the two schemes pick answers like detective when the question asked for a type; candidates who keep them separate collect easy marks.