What are the three types of security controls?

What are the three types of security controls?

The three types of security controls are administrative, technical, and physical, grouped by how a control is implemented. A second common set of three groups controls by when they act: preventive, detective, and corrective. Both lists are correct because they measure different things, and every control has a type on each axis. Multi-factor authentication, for example, is both technical and preventive.

By implementation: administrative, technical, physical

Type	What it is	Examples
Administrative	Policies, procedures, and people-run processes	Security policies, training, background checks, access reviews, vendor assessments
Technical	Controls enforced by hardware or software	MFA, encryption, firewalls, logging, endpoint protection
Physical	Controls on physical access to facilities and devices	Badge readers, locked server rooms, cameras, device disposal

This is the grouping the HIPAA Security Rule uses for its administrative, physical, and technical safeguards. Administrative controls are sometimes called managerial controls, and older NIST guidance split them further into management and operational classes.

By function: preventive, detective, corrective

Type	When it acts	Examples
Preventive	Before an incident, to stop it	MFA, least-privilege access, code review before merge
Detective	During or after, to surface it	Log alerts, intrusion detection, access reviews, vulnerability scans
Corrective	After, to limit damage and restore	Incident response, restoring from backup, revoking a compromised key

Some frameworks extend this list with deterrent controls (warning banners), recovery controls (disaster recovery), and compensating controls (an alternative used when the standard control is not feasible). The three above are the core.

How the two axes combine

Reading a control on both axes shows where a program is thin. A company with strong preventive technical controls but no detective controls will not know when prevention fails. A program heavy on administrative controls with few technical ones depends on people following documents.

Control	By implementation	By function
MFA on the identity provider	Technical	Preventive
Quarterly user access review	Administrative	Detective
Branch protection requiring pull request approval	Technical	Preventive
Incident response plan	Administrative	Corrective
Badge access to the office	Physical	Preventive

SOC 2 does not require either classification, but auditors expect a mix. In practice, detective administrative controls such as access reviews generate the most evidence requests, because they run periodically and the auditor samples each occurrence. For how auditors test those occurrences, see the four types of tests of controls.