Security Controls

Security controls are the building blocks of a defense program. They are typically classified by function (preventive, detective, corrective, deterrent, compensating, recovery) and by type (administrative such as policies, technical such as firewalls and EDR, physical such as locks and badges). Frameworks like NIST SP 800-53, ISO/IEC 27001/27002, and CIS Controls provide control catalogs that organizations select and tailor based on risk and regulatory requirements. Effective programs map controls to threats and assets, monitor their operating effectiveness, and continuously evolve the catalog as the environment and threat landscape change.