Domain 1 of 5 · Chapter 4 of 5

Understand Cybersecurity Controls

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Three control types, sorted by mechanism
  • Technical controls
  • Administrative controls
  • Physical controls at doors, perimeters and grounds
  • Deter, delay, detect, respond
  • Environmental and supporting-utility controls
  • Combining the three control types
  • Compensating controls
  • Choosing and classifying controls

Technical vs administrative vs physical controls

QuestionTechnical controlsAdministrative controlsPhysical controls
What performs the protection?Hardware, software or firmware inside the systemPeople following policies, procedures and agreementsTangible barriers, devices and facility protections
Typical examplesFirewall rules, file permissions, encryption, antivirus softwareSecurity policy, awareness training, personnel screening, access agreements, auditsDoor locks, fences, bollards, cameras, intrusion sensors, lighting, cooling, UPS
What it cannot do aloneMake people follow procedures, or stop someone carrying equipment out of the buildingTechnically block an action a person decides to take anywayControl what an authorized user does once logged in to a system
Tempting misclassificationCalling the policy that requires the firewall a technical controlCalling an online training course technical because it runs on a computerCalling a card-reader door lock technical because it is electronic
Name in CompTIA Security+ (SY0-701)Technical (a category)Not a Security+ category name (its four categories are technical, managerial, operational and physical)Physical (a category)

Decision tree

Done by a tangible barrier, camera,motion or door sensor, or facility protection?Runs in the system's hardware,software or firmware?Directs or checks whatpeople do?Physical controlseven when electronicTechnical controlsfirewalls, permissionsAdministrative controlspolicies, training, auditsReassess the mechanismnone of the three typesfits yetYesNoYesNoYesNoStands in for a recommended control with equivalent or comparable protection?Then it is a compensating control: classify it by what performs the protection
Cheat sheet

Cheat sheet

  • Technical controls protect systems through hardware or software mechanisms
  • Firewall filtering technically enforces network access decisions
  • Technical protection must work with administrative and physical safeguards
  • A compensating control supplies comparable protection in place of another control
  • Administrative controls direct how people manage and use systems
  • Personnel screening helps establish suitability for trusted positions
  • Access agreements establish obligations for people entrusted with information
  • An independent audit reviews evidence of control adequacy and compliance
  • Locks directly restrict opening a secured door
  • Physical barriers must match the type of unauthorized approach
  • Camera systems support observation and detection rather than physically blocking entry
  • Physical intrusion sensors need a monitored route for response
  • Physical delay measures buy time for detection and response
  • Environmental controls protect systems from harmful operating conditions
  • A UPS supplies immediate temporary power during an interruption
  • Facility location changes which environmental safeguards matter
  • Security lighting improves observation and can deter intrusion

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://csrc.nist.gov/glossary/term/security_control
  2. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  3. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf
  4. https://assets.ctfassets.net/82ripq7fjls2/6TYWUym0Nudqa8nGEnegjG/0f9b974d3b1837fe85ab8e6553f4d623/CompTIA-Security-Plus-SY0-701-Exam-Objectives.pdf
  5. https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf
  6. https://csrc.nist.gov/glossary/term/operational_controls
  7. https://csrc.nist.gov/glossary/term/technical_controls
  8. https://csrc.nist.gov/glossary/term/firewall
  9. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf
  10. https://csrc.nist.gov/glossary/term/personnel_security
  11. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
  12. https://csrc.nist.gov/glossary/term/audit
  13. https://www.cisa.gov/resources-tools/programs/chemlock/delay
  14. https://www.cisa.gov/sites/default/files/2026-07/dams-sector-active-and-passive-vehicle-barriers-guide-2026-508.pdf
  15. https://www.cisa.gov/resources-tools/programs/chemlock/detection
  16. https://csrc.nist.gov/glossary/term/uninterruptible_power_supply
  17. https://csrc.nist.gov/glossary/term/defense_in_depth
  18. https://csrc.nist.gov/glossary/term/compensating_security_control