Control Types and Purposes

You achieve access control through an entire set of controls which, identified by purpose, include

check.png Preventive controls, for reducing risk

check.png Detective controls, for identifying violations and incidents

check.png Corrective controls, for remedying violations and incidents and improving existing preventive and detective controls

check.png Deterrent controls, for discouraging violations

check.png Recovery controls, for restoring systems and information

check.png Compensating controls, for providing alternative ways of achieving a task

You implement most access control mechanisms with the primary goal of reducing risk (that is, they’re preventive in nature). Detective, corrective, deterrent, recovery, and compensating controls work in a complementary manner with preventive controls to help create an organization’s overall security posture.

For example, detective controls help to determine when preventive ...

Get CISSP For Dummies, 4th Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.