Complete CISSP Guide to Administrative, Technical, and Physical Controls

In This Guide

• What Are Security Controls?

• Why Security Controls Matter

• Objectives of Security Controls

• Categories of Security Controls

• Functional Types of Security Controls

• Administrative Controls

• Technical Controls

• Physical Controls

• Security Control Matrix

• Real-World Examples

• CISSP Exam Tips

• Common Mistakes

• CISSP Practice Questions

• Key Takeaways

• Related CISSP Articles

What Are Security Controls?

Security controls are safeguards or countermeasures designed to protect the confidentiality, integrity, and availability (CIA) of information and systems.

A security control may consist of:

• Policies

• Procedures

• Technologies

• Hardware

• Software

• Training

• Physical protections

• Operational processes

Their purpose is to reduce risk to an acceptable level.

Why Security Controls Matter

Organizations face threats from:

• Cybercriminals

• Insider threats

• Human error

• Natural disasters

• Hardware failures

• Nation-state attacks

Without effective security controls, organizations cannot adequately protect:

• Sensitive information

• Business operations

• Customer trust

• Regulatory compliance

• Critical infrastructure

Security controls are the foundation of:

• Risk Management

• Security Governance

• Compliance Programs

• Zero Trust

• Defense in Depth

Objectives of Security Controls

Security controls help organizations:

• Reduce risk

• Prevent attacks

• Detect incidents

• Respond quickly

• Recover operations

• Meet legal requirements

• Protect business reputation

• Support business continuity

Categories of Security Controls

CISSP classifies security controls into three primary categories.

1. Administrative Controls

Also called:

• Management Controls

• Procedural Controls

These are implemented through policies, standards, procedures, and people.

Examples include:

• Security policies

• Acceptable Use Policy (AUP)

• Password policy

• Risk assessments

• Employee background checks

• Security awareness training

• Change management

• Vendor management

• Incident response procedures

• Disaster recovery planning

Administrative controls establish how security should be implemented.

2. Technical Controls

Also called:

• Logical Controls

These are implemented using technology.

Examples include:

• Firewalls

• Antivirus

• Endpoint Detection & Response (EDR)

• Intrusion Detection Systems (IDS)

• Intrusion Prevention Systems (IPS)

• Multi-Factor Authentication (MFA)

• Encryption

• VPN

• Network segmentation

• Access Control Lists (ACLs)

• Identity and Access Management (IAM)

• Security Information and Event Management (SIEM)

Technical controls automatically enforce security policies.

3. Physical Controls

These protect facilities, equipment, and personnel.

Examples include:

• Security guards

• Locks

• Fences

• Badge readers

• CCTV

• Motion detectors

• Mantraps

• Biometric door access

• Fire suppression systems

• Environmental monitoring

• Server room security

Physical controls protect against both unauthorized access and environmental threats.

Functional Types of Security Controls

Security controls are also classified by what they do.

Preventive Controls

Prevent incidents before they occur.

Examples:

• MFA

• Firewalls

• Encryption

• Security awareness training

• Locked doors

• Least privilege

• Network segmentation

Primary goal:

Stop attacks.

Detective Controls

Identify security events after they occur.

Examples:

• SIEM

• IDS

• CCTV

• Security logs

• File Integrity Monitoring (FIM)

• Vulnerability scanning

• Audit logs

Primary goal:

Detect attacks quickly.

Corrective Controls

Restore systems after an incident.

Examples:

• Restore from backup

• Malware removal

• Patch deployment

• System rebuild

• Disaster Recovery procedures

Primary goal:

Return to normal operations.

Deterrent Controls

Discourage attackers.

Examples:

• Warning banners

• Visible security cameras

• Security guards

• Lighting

• Legal notices

Primary goal:

Discourage malicious behavior.

Recovery Controls

Help restore business services.

Examples:

• Disaster Recovery Plan

• Business Continuity Plan

• Backup systems

• Alternate data centers

• Cloud failover

Primary goal:

Resume operations quickly.

Compensating Controls

Alternative controls used when the primary control cannot be implemented.

Example:

Legacy software cannot support MFA.

Compensating controls:

• VPN

• Network isolation

• Jump server

• Continuous monitoring

Directive Controls

Provide guidance on expected behavior.

Examples:

• Policies

• Standards

• Procedures

• Security baselines

• Configuration standards

Primary goal:

Direct user behavior.

Security Control Matrix

Real-World Examples

Example 1

An employee completes annual security awareness training.

Control Type

Administrative

Function

Preventive

Example 2

A firewall blocks malicious traffic.

Control Type

Technical

Function

Preventive

Example 3

Security cameras record unauthorized entry.

Control Type

Physical

Function

Detective

Example 4

Backups restore encrypted servers after ransomware.

Control Type

Technical

Function

Recovery

Example 5

Warning signs stating "Authorized Personnel Only."

Control Type

Physical

Function

Deterrent

Security Controls and Defense in Depth

Defense in Depth uses multiple layers of controls.

Example:

• Security Policy

• Employee Training

• MFA

• Firewall

• IDS

• Encryption

• CCTV

• Security Guards

• Backup Systems

If one control fails, others continue protecting the organization.

Security Controls and Risk Management

Risk management determines:

• Which controls are needed

• Which risks require mitigation

• Which controls are cost-effective

• Which risks may be accepted

Controls are selected based on:

• Threats

• Vulnerabilities

• Asset value

• Business objectives

• Compliance requirements

Security Controls and Zero Trust

Zero Trust relies heavily on technical controls such as:

• Continuous authentication

• Least privilege

• Micro-segmentation

• Device verification

• Identity-based access

• Continuous monitoring

Administrative and physical controls continue to play important supporting roles.

CISSP Exam Tips

Remember these mappings:

• Policies → Administrative

• Security Awareness → Administrative

• MFA → Technical

• Encryption → Technical

• Firewall → Technical

• IDS → Detective

• IPS → Preventive

• CCTV → Detective

• Security Guard → Physical

• Mantrap → Physical

• Backup → Recovery

• Warning Banner → Deterrent

The CISSP exam often asks which control best reduces risk, not just which control exists.

Common CISSP Mistakes

❌ Confusing administrative and technical controls.

❌ Thinking IDS prevents attacks (it primarily detects them).

❌ Assuming all cameras prevent attacks (they are mainly detective).

❌ Believing backups are preventive controls (they are recovery controls).

❌ Forgetting that policies themselves are security controls.

❌ Mixing control categories (administrative, technical, physical) with control functions (preventive, detective, corrective, etc.).

CISSP Practice Questions

Question 1

Which of the following is an administrative security control?

A. Firewall

B. IDS

C. Security Awareness Training

D. Encryption

Answer: C

Question 2

Which security control detects malicious network traffic?

A. IPS

B. IDS

C. VPN

D. MFA

Answer: B

Question 3

Which control restores operations after ransomware?

A. Firewall

B. Backup Restoration

C. CCTV

D. Password Policy

Answer: B

Question 4

A warning sign stating "Violators Will Be Prosecuted" is which type of control?

A. Detective

B. Preventive

C. Deterrent

D. Recovery

Answer: C

Question 5

Which combination best demonstrates Defense in Depth?

A. Firewall only

B. Antivirus only

C. Firewall + MFA + IDS + Backup + Security Awareness

D. Password Policy only

Answer: C

Key Takeaways

• Security controls reduce organizational risk.

• CISSP groups controls into Administrative, Technical, and Physical categories.

• Controls also have functions such as Preventive, Detective, Corrective, Recovery, Directive, Deterrent, and Compensating.

• Effective security uses Defense in Depth, combining multiple control layers.

• Security controls should align with business objectives, risk assessments, and regulatory requirements.

• Understanding both the category and function of a control is essential for CISSP success.

Related Domain 1 Articles

• CIA Triad

• Security Governance

• Security Governance vs. IT Governance

• Risk Management

• Risk Appetite & Risk Tolerance

• Data Classification

• Security Policies

• Least Privilege

• Defense in Depth

• Business Continuity Planning

• Disaster Recovery

• Security Concepts

• Authentication and Authorization

• Identity and Access Management

• Cryptography

• Zero Trust Architecture

• COBIT

• NIST Cybersecurity Framework (CSF)

• ISO/IEC 27001

• CIS Critical Security Controls

• Security Awareness Training