Categories of Controls

Controlling risk through mitigation, avoidance or transference is accomplished by implementing controls. There are 4 effective approaches to select the controls by category:

Control function: Controls (safeguards) designed to defend systems are preventive or detective.

Architectural layer: Some of the controls apply to one or more layers of organization’s technical architecture

Strategy layer: Controls classified by risk control strategy (avoidance, transference, mitigation) in which they operate.

Information security principle: Controls can be classified according to characteristics of secure information they assure. These characteristics include: accountability integrity, availability, confidentiality, authorization, authentication, and privacy.