--- question: "What are the three types of security controls?" title: "What Are the Three Types of Security Controls" seoTitle: "The 3 Types of Security Controls Explained" summary: "The three types of security controls are usually given as administrative, technical, and physical, which classifies controls by how they are implemented. A second, equally common set of three classifies controls by when they act: preventive, detective, and corrective. Both are correct and they describe different axes, so any single control has one type from each: multi-factor authentication is a technical, preventive control, and a quarterly access review is an administrative, detective control. The administrative, physical, and technical grouping is also the structure of the HIPAA Security Rule's safeguards." publishedAt: "2026-09-14" keywords: - "three types of security controls" - "administrative technical physical controls" - "preventive detective corrective controls" - "examples of operational controls" pillar: "Beyond SOC 2" faqs: - question: "what are examples of operational controls?" answer: "Operational controls are security measures carried out by people following a process, rather than by a system. Examples include security awareness training, onboarding and offboarding checklists, access reviews, incident response procedures, backup testing, and visitor sign-in. Older NIST guidance grouped controls as management, operational, and technical, and the operational group covered exactly this kind of people-run process." - question: "Is MFA a preventive or detective control?" answer: "Preventive. Multi-factor authentication stops an unauthorized login before it happens. By implementation it is a technical control, since a system enforces it. An alert on failed MFA attempts, by contrast, is a detective control, because it reports an attempt rather than blocking it." - question: "What are the 3 HIPAA safeguards?" answer: "Administrative, physical, and technical safeguards, as defined in the HIPAA Security Rule. Administrative safeguards cover risk analysis, workforce training, and security management. Physical safeguards cover facility and device access. Technical safeguards cover access control, audit logging, integrity, and transmission security for electronic protected health information." --- ## What are the three types of security controls? The three types of security controls are **administrative, technical, and physical**, grouped by how a control is implemented. A second common set of three groups controls by when they act: **preventive, detective, and corrective**. Both lists are correct because they measure different things, and every control has a type on each axis. Multi-factor authentication, for example, is both technical and preventive. ## By implementation: administrative, technical, physical | Type | What it is | Examples | |---|---|---| | Administrative | Policies, procedures, and people-run processes | Security policies, training, background checks, access reviews, vendor assessments | | Technical | Controls enforced by hardware or software | MFA, encryption, firewalls, logging, endpoint protection | | Physical | Controls on physical access to facilities and devices | Badge readers, locked server rooms, cameras, device disposal | This is the grouping the HIPAA Security Rule uses for its administrative, physical, and technical safeguards. Administrative controls are sometimes called managerial controls, and older NIST guidance split them further into management and operational classes. ## By function: preventive, detective, corrective | Type | When it acts | Examples | |---|---|---| | Preventive | Before an incident, to stop it | MFA, least-privilege access, code review before merge | | Detective | During or after, to surface it | Log alerts, intrusion detection, access reviews, vulnerability scans | | Corrective | After, to limit damage and restore | Incident response, restoring from backup, revoking a compromised key | Some frameworks extend this list with deterrent controls (warning banners), recovery controls (disaster recovery), and compensating controls (an alternative used when the standard control is not feasible). The three above are the core. ## How the two axes combine Reading a control on both axes shows where a program is thin. A company with strong preventive technical controls but no detective controls will not know when prevention fails. A program heavy on administrative controls with few technical ones depends on people following documents. | Control | By implementation | By function | |---|---|---| | MFA on the identity provider | Technical | Preventive | | Quarterly user access review | Administrative | Detective | | Branch protection requiring pull request approval | Technical | Preventive | | Incident response plan | Administrative | Corrective | | Badge access to the office | Physical | Preventive | SOC 2 does not require either classification, but auditors expect a mix. In practice, detective administrative controls such as access reviews generate the most evidence requests, because they run periodically and the auditor samples each occurrence. For how auditors test those occurrences, see [the four types of tests of controls](/resources/answers/what-are-the-4-types-of-tests-of-controls).