Security control categories and types
Two questions, two answers: category and type
Every security control can be described on two independent axes. The category says what the control is made of and who or what operates it: technical, managerial, physical or operational. The type says what the control does relative to an incident: preventive, deterring, detective, corrective, compensating or directive. The decision rule for exams: read which axis the question asks about, then classify on that axis only. A security camera is physical in category and detective in type, and both statements are true at once.
This guide uses the SY0-801 (Security+ V8) objective 1.1 vocabulary. V8 launches on November 17, 2026, and SY0-701 stays bookable until then. The two use closely related lists, so the method below works for both.
The category axis
| Category | Made of | Typical examples |
|---|---|---|
| Technical (logical) | Software, hardware settings, code | Firewall rules, encryption, access control lists, antivirus, MFA |
| Managerial (administrative) | Decisions and governance | Policies, risk assessments, security reviews, approval processes |
| Physical (environmental) | Things in the real world | Locks, fences, cameras, access vestibules, fire suppression |
| Operational | Routines carried out by people | Awareness training, onboarding and offboarding procedures, guard rounds |
Operational is the fuzzy one. A rule of thumb that works: if a person performs it day to day, it is operational; if it is the written rule that tells them to, it is managerial. Questions usually make the choice clear through the example, but guards and training programmes are the items where wording matters most.
The type axis
| Type | Question it answers | Example |
|---|---|---|
| Preventive | Does it stop the event from happening? | Firewall block, door lock |
| Deterring | Does it discourage the attempt? | Warning signs, visible cameras, a login banner |
| Detective | Does it notice that something happened? | IDS alert, log review, motion sensor |
| Corrective | Does it limit damage and restore normal state? | Restoring from backup, patching after an incident |
| Compensating | Does it stand in when the intended control cannot be used? | Network isolation for a system that cannot be patched |
| Directive | Does it tell people what they must do? | Acceptable use policy, standard operating procedure |
Think of the type axis as a timeline: before the event (deter, prevent), during or just after (detect), afterwards (correct). Directive and compensating sit outside the timeline: directive is about instruction, compensating is about substitution.
A method for classifying any control
- Underline the control itself, not the situation around it.
- Ask what it is made of for the category: code or configuration (technical), paper and decisions (managerial), physical object (physical), human routine (operational).
- Ask what it does for the type: stops, discourages, notices, repairs, replaces, instructs.
- Check that the answer fits the axis the question names.
Worked example
A company has a legacy machine-control server that cannot be patched. The security team places it on an isolated VLAN with a firewall rule that allows only the engineering workstation to reach it, and writes a procedure for monitoring it.
| Control | Category | Type |
|---|---|---|
| Isolated VLAN with restrictive firewall rule | Technical | Compensating (it substitutes for patching); also preventive in effect |
| The written monitoring procedure | Managerial | Directive |
| Log alerts on connection attempts | Technical | Detective |
| Restoring the server from its last good image after a fault | Technical | Corrective |
The VLAN row shows why options matter. If the question says “the patch cannot be applied, so the team does this instead”, the answer is compensating. If it says “to stop other hosts reaching the server”, preventive is the better fit. The same control can be correct for either, so the stem decides.
How the controls link to other frameworks
Control language is not unique to CompTIA. Frameworks such as NIST SP 800-53 organise controls into families, and exam questions on governance reuse the same ideas. See security frameworks for how they fit together and risk management for how controls reduce risk during treatment. Controls also show up in Zero Trust, where least privilege and verification are implemented by technical controls, and in ACLs, a classic technical preventive control.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| SY0-801 | Domain 1 General Security Concepts (16%), objective 1.1: control categories (technical, managerial, physical, operational) and control types (preventive, deterring, corrective, detective, compensating, directive). V8 launches Nov 17, 2026; SY0-701 until then | General security concepts, cheat sheet |
Other exams in this set mention security controls in a product sense (for example SC-500 and CY0-001 implement controls with Azure or AI tooling), but their outlines do not ask you to classify them by category and type, so they are left out.
How exam questions are built around controls
The typical trap is mixing the two axes: the stem asks for the type, and a distractor is a correct category. If the stem asks for the type of an awareness programme, “operational” is a category and cannot be the answer, however true it is; check which axis each option names. Constraint words that decide the answer:
- “Discourage” or “warn” means deterring, not preventive. A sign does not stop anyone.
- “Alternative” or “cannot be implemented” means compensating.
- “After the incident”, “restore”, “recover” means corrective.
- “Identify”, “alert”, “review logs” means detective.
- “Policy states” or “instruct” means directive and, in category, managerial.
- “Guard”, “lock”, “fence” signals physical, unless the stem emphasises procedure.
Another trap is multi-category controls. A camera with software-driven motion alerts has both physical and technical parts. When the answer must be one, choose the category that matches the item the stem names.
Question 1. A company cannot install a security update on an old medical device, so it moves the device to a separate network segment reachable only from one management host. What type of control is the segmentation?
- A. Detective
- B. Corrective
- C. Compensating
- D. Directive
Show answer
Answer: C
The segmentation takes the place of the patch that cannot be applied, which is the definition of a compensating control. Detective controls notice events, corrective controls restore after an event, and directive controls instruct people through policy. The segmentation does none of those.
Question 2. The security manager publishes an acceptable use policy that all staff must sign. Which pair correctly describes the control?
- A. Managerial category, directive type
- B. Technical category, preventive type
- C. Physical category, deterring type
- D. Operational category, corrective type
Show answer
Answer: A
A written policy is a decision and governance document, so its category is managerial, and it tells people what to do, so its type is directive. Technical controls act through software or hardware. Preventive describes a control that stops an event, which a signed policy alone does not do. Physical controls are objects in the real world.