Headline: Stop Threats Before They Start, Catch Them When They Slip Through, and Fix Them When They Fail
The Three Lines of Defense
IT controls are categorized by their purpose: preventive, detective, or corrective. Each plays a distinct role in a defense-in-depth strategy. Comprehensive coverage requires all three working together.
Preventive Controls
Purpose: To stop an undesirable event from occurring in the first place.
Characteristics:
- Proactive
- Most effective (prevents harm entirely)
- Often the most cost-effective
- Cannot prevent all events
Examples:
|
Category |
Example |
|
Access Control |
Password policies, MFA, role-based access control (RBAC) |
|
Network Security |
Firewalls, intrusion prevention systems (IPS) |
|
Application Security |
Input validation, secure coding practices |
|
Physical Security |
Badge access, security guards |
Real-world application: CIS Control 6 focuses on access control management—using processes and tools to create, assign, manage, and revoke access credentials and privileges . Accounts should only have the minimal authorization needed for the role, and developing consistent access rights for each role is a best practice .
Detective Controls
Purpose: To identify an undesirable event after it has occurred.
Characteristics:
- Reactive
- Essential when preventive controls fail
- Provide visibility into security posture
- Enable rapid response
Examples:
|
Category |
Example |
|
Logging |
System logs, audit trails |
|
Monitoring |
SIEM, intrusion detection systems |
|
Auditing |
Access reviews, compliance assessments |
|
Analysis |
Anomaly detection, trend analysis |
Corrective Controls
Purpose: To restore the system after an undesirable event.
Characteristics:
- Reactive
- Minimize impact of failures
- Enable recovery
- Essential for resilience
Examples:
|
Category |
Example |
|
Backup and Recovery |
Data backups, disaster recovery |
|
Incident Response |
IR plans, containment procedures |
|
Patch Management |
Vulnerability remediation |
|
Restoration |
System restoration, data recovery |
The Defense-in-Depth Model
Effective controls management uses all three types in layers:
text
Preventive → Detective → Corrective
(Stop it) → (Find it) → (Fix it)
Example: Ransomware Protection
|
Layer |
Control Type |
Example |
|
Layer 1 |
Preventive |
Anti-malware software, email filtering, user training |
|
Layer 2 |
Detective |
Endpoint detection and response (EDR), threat hunting |
|
Layer 3 |
Corrective |
Backup and recovery, incident response |
The Problem with Controls Proliferation
Many organizations have built up layers of controls reactively—responding to regulatory changes, incidents, and shifting priorities. The result is often a complex and burdensome framework weighed down by excess controls, many of which are inefficient, redundant, or misaligned with actual risk and compliance needs .
The consequences:
- Demonstrating effective risk management becomes difficult
- Increased risk of non-compliance as controls are misaligned with regulatory expectations
- Ineffective assurance and audit fatigue as excessive controls dilute testing capacity
- Ineffective and complex change management as it's harder to update and embed controls
Conclusion
A balanced approach to controls management incorporates preventive, detective, and corrective controls. Preventive controls are the first line of defense, detective controls catch what slips through, and corrective controls restore services when failures occur. Organizations should review their control mix to ensure balanced coverage.
Action Items for Your Organization
- Classify your existing controls as preventive, detective, or corrective
- Identify gaps in your control mix
- Ensure you have appropriate coverage across all three types
- Review and rationalize controls to eliminate redundancy
- Prioritize controls that address the most significant risks
