Information security controls are the mechanisms that reduce the likelihood or impact of a risk materializing. But not all controls do the same thing, and understanding the difference matters when you are deciding where and how to deploy them, when you are explaining your control rationale to an auditor, and when you are trying to identify gaps in your coverage.
Five Types of Information Security Controls
Information security controls fall into five categories based on what they do when a threat is present. Each addresses a different phase of an attack or incident. Together they form the structure that frameworks like NIST SP 800-53, ISO 27001, and CIS Controls use to organize their control catalogs.
Directive
Policies, procedures, and guidelines that tell people what to do and what not to do. Acceptable use policies, security awareness training, and access control standards are directive controls. They set expectations before anything happens and give the technical controls operational meaning. The authority behind directive controls comes from governance — a policy that nobody signed and no manager enforces is a directive control in name only.
Preventative
Controls that stop a threat from being realized. Firewalls, MFA, encryption, and network segmentation are preventative. The goal is to block the attack before it succeeds.
Detective
Controls that identify when something has gone wrong. Log monitoring, intrusion detection, and audit trails are detective controls. They do not stop the attack. They tell you it happened and give you something to investigate.
Corrective
Controls that restore systems and operations after an incident. Backups, incident response procedures, and patch management fall here. The goal is to minimize the duration and scope of impact.
Compensating
Alternative controls deployed when a primary control is not feasible. If a system cannot support MFA, a compensating control might be network isolation combined with enhanced logging. Compensating controls do not replace the missing control. They reduce the risk created by its absence. Compensating controls require formal documentation, justification, and periodic review. An undocumented compensating control is functionally the same as no control.
The Complete Control
Wherever you place an information security control, the goal is to have all three of these present: preventative, detective, and corrective. Together they form a complete control. Each addresses a different phase and the absence of any one creates a gap that will eventually matter.
A network segment with a firewall but no logging and no recovery plan has a preventative control with nothing behind it. If the firewall is bypassed, you will not know until the damage is done and you will have no structured way to recover. A complete control addresses what happens before, during, and after the threat materializes.
Directive controls are often overlooked because they are not technical. But a firewall nobody is authorized to modify, a logging system nobody is required to review, and a backup nobody is responsible for testing are all incomplete controls. The directive layer is what gives technical controls operational meaning. ISO 27001 requires that controls are not just implemented but operated and maintained, which requires directive controls defining how. HIPAA requires the same: administrative safeguards govern how technical controls are managed and by whom.
Security Controls and Asset Value
The information security controls you deploy and the depth of coverage you provide should be proportional to the value and criticality of the asset being protected. A database containing PHI, financial records, or payment card data warrants a more comprehensive set of controls than a staging environment with no sensitive data. Both might need preventative, detective, and corrective controls, but the depth, redundancy, and rigor should reflect what the asset is worth and what the regulatory consequences of a failure would be. How to establish and document that asset value is covered in Cybersecurity Asset Inventory.
A single strong control is not a security posture. Defense in depth means layering controls so that the failure of one does not result in a complete compromise. When designing control placement, ask what happens if each control fails independently and make sure the answer is not “everything else falls apart.” This is the principle behind requiring preventative, detective, and corrective controls at every critical boundary, not just one of the three.
Control Mapping
NIST SP 800-53 organizes security controls in cybersecurity into families that span all five types. Access control (AC) and identification and authentication (IA) are primarily preventative. Audit and accountability (AU) is detective. Incident response (IR) and contingency planning (CP) are corrective. Planning (PL) and personnel security (PS) are directive. Understanding which type each control family represents helps prioritize implementation and identify gaps in coverage. The full control catalog is available at NIST SP 800-53 Rev 5.
ISO 27001 Annex A organizes its 93 controls across four themes: organizational, people, physical, and technological. When conducting an ISO 27001 gap assessment, mapping each Annex A control to a control type helps identify whether you have balanced coverage or are overweighted toward one phase.
NIST CSF PR (Protect), DE (Detect), and RS (Respond) functions map directly to preventative, detective, and corrective respectively. The complete control framework maps cleanly onto CSF’s core functions, which is why understanding control types is prerequisite to using CSF effectively. How CSF structures those functions into an assessment workflow is covered in Using the NIST Cybersecurity Framework as a Gap Assessment Tool.
HIPAA 164.308 and 164.312 require both administrative and technical controls, and both categories span all five types. The administrative safeguards under 164.308 are largely directive and corrective. The technical safeguards under 164.312 are preventative and detective. A HIPAA-compliant security program requires all five control types to be present and documented.
The Point
Information security controls without a clear taxonomy produce coverage that looks complete on paper and falls apart under scrutiny. Knowing what each control does and what phase it addresses is what allows you to identify gaps before an assessor does.