Types of security controls include:
Image
Deterrent
Deterrent controls discourage potential attackers by signaling the presence of security (e.g., visible surveillance or policy warnings).
Preventive
Preventive controls, which are designed to stop incidents before they occur. Examples include firewalls, access controls, and security policies.
Detective
Detective controls, which identify and alert administrators to suspicious activities. These might involve intrusion detection systems (IDS), security information and event management (SIEM) systems, or system logs.
Corrective
Corrective controls aim to restore systems after an incident has occurred, such as backup restoration, patching vulnerabilities, or reimaging infected machines.
Compensating
Compensating controls serve as alternatives when standard controls are impractical, yet still meet security requirements.