4.3.1. Control Design and Selection
💡 First Principle: Selecting a control is a business trade-off between cost, friction, and risk reduction — not a purely technical exercise — because the most airtight control is worthless if it gets disabled the first time it blocks a revenue-generating process.
Controls are commonly categorized as preventive (stop an event before it happens, like access controls), detective (identify an event that's already occurring or has occurred, like log monitoring), and corrective (limit damage and restore normal operation after an event, like a rollback procedure). A mature program deliberately layers all three categories, because no single category can fully address every risk — a determined insider with legitimate access can bypass most preventive controls, which is exactly why detective and corrective layers matter just as much as prevention.
A fourth category, the compensating control, exists for exactly the situation where the appropriate primary control can't actually be applied — a legacy system that can't be patched without breaking a critical business process, for example. A compensating control doesn't fix the underlying gap directly; it achieves an equivalent level of risk reduction through a different mechanism, such as isolating the unpatched system on its own network segment or placing a web application firewall in front of it. The compensating control is only acceptable if it genuinely closes the same risk the primary control would have — not simply the easiest alternative available.
⚠️ Exam Trap: Preventive controls are frequently assumed to be the best category to invest in. The correct reasoning recognizes that some risks — particularly insider threats and zero-day exploits — cannot be fully prevented, making detective and corrective controls equally essential rather than a lesser fallback.
⚠️ Exam Trap: A compensating control is sometimes treated as an acceptable substitute merely because the primary control is inconvenient or costly to implement. The correct reasoning reserves compensating controls for cases where the primary control is genuinely infeasible, and requires the substitute to achieve comparable risk reduction, not just lower friction.
Reflection Question: A trusted employee with legitimate system access decides to exfiltrate data. Which control category — preventive, detective, or corrective — is most likely to actually catch this, and why does that change your program's control mix?
