Types of security control and defence in depth
In short: Security controls are the safeguards that reduce risk. They are grouped by what they do (prevent, detect, correct) and how they are delivered (administrative, technical, physical). Strong security layers several kinds so that no single failure exposes everything.
What a security control is
A security control is any measure that reduces risk to people, systems or data. A locked server room, a password policy, a firewall rule and a backup are all controls. Choosing controls is the practical side of risk management: you look at what could go wrong, then pick safeguards that make it less likely or less damaging.
Controls by purpose
| Purpose | What it does | Examples |
|---|---|---|
| Preventive | Stops an incident from happening | MFA, firewall rules, door locks |
| Detective | Finds an incident while or after it happens | Log alerts, CCTV, intrusion detection |
| Corrective | Limits damage and restores normal service | Restoring backups, isolating an infected PC |
| Deterrent | Discourages an attacker from trying | Warning banners, visible cameras |
| Compensating | Stands in when the ideal control isn't possible | Extra monitoring on a system that can't be patched |
Controls by type
- Administrative (managerial): policies, procedures, training, background checks and risk assessments.
- Technical (logical): technology that enforces security, such as encryption, access control lists, antivirus and MFA.
- Physical: protection you can touch, such as fences, badges, locks, guards and fire suppression.
Every control has both a purpose and a type. A security camera is a physical detective control; an acceptable use policy is an administrative preventive control.
Defence in depth
No single control is perfect. Phishing emails get past filters, people reuse passwords, and patches arrive late. Defence in depth layers different controls so an attacker who beats one still faces the next. Mix purposes too: if prevention fails, detection should notice, and correction should limit the damage.
Choosing the right controls
- Start from the risk: what asset, what threat, what impact?
- Pick at least one preventive and one detective control for each important risk.
- Check the cost is proportionate to the risk.
- Assign an owner and test that the control actually works.
- Review controls after incidents and changes.
Tip: frameworks such as the CIS Controls give a ready-made, prioritised list of technical safeguards to start from.
Real-world example: protecting a school server room
A school keeps its main server and network cabinet in a small room off the library. A risk review finds that the door is often propped open. The IT manager uses several kinds of control together: a keypad lock and a door-closer (physical, preventive), a sign stating that the room is monitored (deterrent), a camera recording the doorway (physical, detective), a short policy on who may enter (administrative, preventive) and nightly backups stored off site (technical, corrective). If one control fails, for example someone shares the keypad code, the camera and backups still limit the harm.
Practice
A company adds a login banner warning that activity is monitored. What kind of control is it?
Is restoring files from backup preventive, detective or corrective?
Why combine preventive and detective controls?
Key takeaways
- Controls reduce risk; each has a purpose and a type.
- Purposes: preventive, detective, corrective, plus deterrent and compensating.
- Types: administrative, technical and physical.
- Defence in depth layers different controls so one failure is not fatal.
- Choose controls from the risk, assign owners and test them.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.