GRC · 5 min
Security Controls
What they're for, and whether they actually work
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Control purposes
The most useful classification is by what the control is meant to achieve at the moment it acts.
- Preventive — stops the event happening
- Detective — reveals that something happened
- Corrective — restores or limits damage afterwards
Control types
A second axis describes how the control is implemented. Both axes are descriptive tools, not rigid taxonomies.
- Administrative — policy, process, training, approvals
- Technical — enforced by systems
- Physical — locks, barriers, environmental protection
Loading the interactive lesson…