Domain 1 · Objective reference 1.4 · Chapter 4 of 19
Administrative, technical and physical controls
About 5 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A control has a mechanism and a purpose.
Explore the anchors
Rules training and assigned duties.
Concept matching activity
Match this task or description to its concept:
Enforcement through systems.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Classify how a control works
- Distinguish prevention, detection and correction
Classify how a control works
Administrative controls operate through direction, roles and processes: policies, training, approval and personnel procedures. Technical controls operate through systems, such as access enforcement, encryption, logging or filtering. Physical controls address access to premises and equipment, such as locks, barriers, guards and environmental protection. A control can depend on multiple categories: an electronic badge system has technical components, physical enforcement and an administrative approval process.
Control categories describe implementation, not effectiveness. A documented approval process can fail if staff bypass it, and a sophisticated firewall can fail if its rule permits the unwanted path. Identify the objective and evidence before concluding that a category is covered.
Distinguish prevention, detection and correction
Preventive controls aim to stop an unwanted action. Detective controls reveal conditions or events requiring attention. Corrective controls restore or improve a state after a failure; recovery controls support service restoration. Deterrence discourages behavior, and compensating controls address an objective where the normal control cannot be used. These functions can overlap, so explain the actual mechanism rather than relying on a label.
Defense in depth uses several meaningful layers. A locked room, restricted administrator account, change log and tested backup address different parts of a tampering scenario. Four tools observing the same unreliable data source do not automatically provide four independent safeguards. Where an AI detector produces alerts, ask who validates them and what authorized action follows.
Worked example
A server-room door is locked, entry is recorded and unexpected entry is reviewed. The lock helps prevent entry; the log and review help detect misuse. A restore procedure supports recovery if equipment or data is damaged.
Check your understanding
A team installs a detection tool but assigns nobody to review alerts. What is missing?
Show explanation
The operational process needed to turn detection into an effective response. Tool presence alone does not establish timely review, escalation or correction.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.