Rule Atlas
NIST SP 800-53: Classifying Security Controls: Categories and Types
Under NIST SP 800-53 (CompTIA / NIST / IETF), classifying Security Controls: Categories and Types establishes the authoritative rules tested on the CompTIA Security+ (SY0-701). A comprehensive guide to classifying security controls by category (Technical, Managerial, Operational, Physical) and type (Preventive, Detective, Corrective, Deterrent, Compensating, Directive) as per CompTIA Security+ SY0-701 and NIST standards. VoraPrep verifies every threshold, worked table, and practice question below against the current CompTIA Security+ (SY0-701) blueprint.
Core Statutory Concepts
| Category | Description | Examples |
|---|---|---|
| Technical | Implemented through hardware or software and directly protect systems. | Firewalls, Intrusion Detection/Prevention Systems (IDPS), Encryption, Antivirus, Access Control Lists (ACLs). |
| Managerial | Policies, procedures, and guidelines established by management to govern security. Also known as Administrative. | Security awareness training, Risk assessments, Security policies (e.g., Acceptable Use Policy), Contingency planning. |
| Operational | Controls implemented by people in day-to-day operations to protect systems and data. | Incident response procedures, Backup and recovery processes, Physical security guards, System monitoring, Vulnerability management. |
| Physical | Tangible controls protecting physical assets, spaces, and personnel from physical threats. | Fences, Locks, Security cameras (CCTV), Biometric readers, Lighting, Environmental controls (HVAC, fire suppression). |
Due to the limitations of an essential legacy system that cannot support modern strong password policies, the IT department implements multi-factor authentication (MFA) as an additional layer of security for accessing this system. This measure is specifically put in place to offset the inherent weakness in password complexity. Implementing multi-factor authentication (MFA) to address the limitations of the legacy system's password policy is an example of which type of security control?
Practitioner Application: Classifying Security Controls: Categories and Types
A junior security analyst, Alex, is tasked with auditing the security posture of a new cloud-based application. Alex needs to accurately classify various security measures to ensure comprehensive coverage and compliance with internal policies and external regulations. Incorrectly classifying controls could lead to misallocated resources or significant security gaps during a critical audit. How should Alex approach the classification of diverse security controls, ranging from policy documents to intrusion detection systems?
- Security controls are safeguards or countermeasures designed to prevent, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. Understanding how to categorize and type these controls is fundamental for any security professional, aligning with the CompTIA Security+ Content Outline (SY0-701 (2024–2026)) and NIST SP 800-53 Rev. 5.
- Security Control Categories These define how a control is implemented or its primary domain of influence.
Common CompTIA Security+ (SY0-701) Distractors on NIST SP 800-53
- 1⚠️ Exam trap: Misclassifying a Deterrent control. While deterrents aim to prevent, their primary function is to discourage. For example, a 'Beware of Dog' sign is a deterrent, not directly preventive like a lock.
- 2⚠️ Exam trap: Overlooking Compensating controls. These are crucial for compliance when a standard control cannot be fully implemented. The scenario will often explicitly state that a primary control is missing or infeasible, necessitating an alternative.
- 3Categories (How): Technical, Managerial, Operational, Physical.
- 4Types (When/What): Preventive, Detective, Corrective, Deterrent, Compensating, Directive.
- 5Understand that some controls can fit multiple categories or types, but focus on the primary function described in the scenario.
Frequently Asked Questions: NIST SP 800-53
What is the core rule under NIST SP 800-53 (Classifying Security Controls: Categories and Types)?
Under NIST SP 800-53 (CompTIA / NIST / IETF), classifying Security Controls: Categories and Types establishes the authoritative rules tested on the CompTIA Security+ (SY0-701). A comprehensive guide to classifying security controls by category (Technical, Managerial, Operational, Physical) and type (Preventive, Detective, Corrective, Deterrent, Compensating, Directive) as per CompTIA Security+ SY0-701 and NIST standards. VoraPrep verifies every threshold, worked table, and practice question below against the current CompTIA Security+ (SY0-701) blueprint.
How is NIST SP 800-53 tested on the CompTIA Security+ (SY0-701)?
⚠️ Exam trap: Misclassifying a Deterrent control. While deterrents aim to prevent, their primary function is to discourage. For example, a 'Beware of Dog' sign is a deterrent, not directly preventive like a lock. ⚠️ Exam trap: Overlooking Compensating controls. These are crucial for compliance when a standard control cannot be fully implemented. The scenario will often explicitly state that a primary control is missing or infeasible, necessitating an alternative.
Where can I practice CompTIA Security+ (SY0-701) questions on Classifying Security Controls: Categories and Types?
Test yourself instantly with the free playable CompTIA Security+ (SY0-701) question on this page, or launch VoraPrep's full CompTIA Security+ (SY0-701) adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/comptiasecurity.