Control Categories vs. Types Matrix
4 Categories × 6 TypesEach cell shows examples of controls that belong to both that category and type.
| Type ↓ / Category → | 🖥️ Technical | 📋 Managerial | 👷 Operational | 🔒 Physical |
|---|---|---|---|---|
| Preventive | Firewall rules, ACLs | Security policy enforcement | Guard shack ID checks | Door locks, fences |
| Deterrent | Login splash screen / legal warning | Threat of demotion policy | Visible reception desk | Warning signs posted |
| Detective | Log review, SIEM alerts | Security audits, login reports | Property patrols | Motion detectors, cameras |
| Corrective | Restore from backup | Incident reporting policies | Contact law enforcement | Fire extinguisher |
| Compensating | Firewall blocks unpatched app | Separation of duties | Dual guard requirement | Generator during outage |
| Directive | Store files in protected folder | Compliance policies & procedures | Security awareness training | "Authorized Personnel Only" sign |
Control Strength Pyramid
Strongest → WeakestPreventive
Corrective
Detective
Compensating
Deterrent
Directive (weakest)
Quick Memory Aid
MnemonicsTMOP
Technical · Managerial · Operational · Physical
"The Manager Oversees People"
PD DC CD
Preventive · Deterrent · Detective · Corrective · Compensating · Directive
Layering Always
No single control is sufficient. Layer categories AND types for defense in depth.