Now, as we mentioned before, controls tend to be considered a proactive. Things that we put in place in an attempt to prevent bad consequences and threats from having their effect. They fall into three general categories, administrative-managerial, which embodies our governance documentation, policies, procedures, standards, baselines, guidelines, et cetera. Things that describe behaviors, conditions, states that we are going to follow.

We have the technical or logical methods, techniques and instrumentalities that we're going to employ to support and are often implementations derived from the administrative section. These can be hardware, software or firmware in their nature. And then we have the physical or operational. These are locks, lighting, guards or other methods that affect the places and spaces where we will be doing our business. Within each of these three high level categories we have different control functions.

Now, these control functions typically fall into four areas. The first being preventive, which will disallow or prevent a threat from having an impact against our asset and within preventive would be deterrent. Now, a true preventive is something that actually stops something from happening. A deterrent discourages only. This could be anything from strong to weak in its deterrent effect, but it is part of the preventive category.

Then we have detective. This provides an advance alert function and may in fact be a secondary function of a preventive control to alert us that something is attempting to penetrate and hopefully will be stopped by the preventive control now sending us the alert as the detective element. Then we have corrective.

Now, corrective enables the adjustment or resetting of misconfigurations on a micro scale. Recovery, another subset of corrective types of controls, is a little bit larger in its scope. It could be considered as a kind of control that we use to recover a system on a macro scale, but it is a part of the overall corrective family of control functions. And then we have compensating.

Now these are blended alternatives to direct controls and these actually are used in many places where a direct option would produce a secondary but unfavorable effect, which is something that we may not be able to tolerate, and so using a combination of preventative, detective and corrective measures from the administrative, technical or physical areas in combination with each other, can provide us the primary impact that we want without providing the secondary effect that we can't tolerate.