Security controls matrix (colored)

Legend — one color per control type

Preventive	Stops it from happening — works even if the attacker doesn't know it's there
Deterrent	Makes the attacker choose not to try — only works if they see it
Detective	Finds out it happened or is happening
Corrective	Fixes / recovers after it happened
Compensating	Substitute for a required control you can't implement — "same or better" (class)
Directive	Tells people what to do

Categories × types

Category ↓ / Type →	Preventive	Deterrent	Detective	Corrective	Compensating	Directive
Technical hardware/software	Firewall, ACL, encryption, MFA, allow list, DEP/ASLR	Login warning banner	IDS, SIEM alerts, log analysis, FIM, honeypot	IPS blocking, patch after exploit, AV quarantine, restore from backup	Extra logging / segmentation when a patch or MFA can't be applied	System prompts, policy pop-ups
Managerial policy/oversight	Background checks, separation of duties, least-privilege policy	Sanctions policy ("violations lead to termination")	Risk assessments, audits, compliance reviews	Incident response plan, lessons-learned updates	Accepting an alternative control via risk exception	Policies, standards, AUP
Operational people doing tasks	Change management execution, backups performed, patch deployment	Guard presence, visible patrols	Guard log review, CCTV monitoring, manual audits	IR team actions, restoring service	Manual review when automation is unavailable	Training, procedures, playbooks
Physical touchable	Locks, bollards, fences (K-rated), mantrap / access control vestibule, cable locks	Signs, lighting, visible cameras, fake cameras	Motion/IR/pressure sensors, alarms, CCTV recording, guard observations	Fire suppression, replacing broken locks, generator kick-in	Guard at a door whose badge reader is broken	"Authorized personnel only" signage

Fast decision tree

Ask	If yes →
Does it tell people what to do?	Directive
Does it replace a control that can't be implemented?	Compensating
Acts before the incident and physically/logically stops it?	Preventive
Acts before but only discourages?	Deterrent
Acts during/after and reveals it?	Detective
Acts after and repairs it?	Corrective

Then category: machine → Technical; policy/plan/oversight → Managerial; person doing a task → Operational; something you can touch → Physical.

The pairs the exam loves to swap

A	B	Difference
IDS	IPS	IDS alerts (detective); IPS blocks (preventive) — class: "IPS → active IDS; IDS → just detects"
Deterrent camera	Detective camera	Visible & warns vs. records & reviewed
Managerial training program	Operational training delivery	The plan vs. the doing
Corrective restore	Preventive backup	Backup exists = preventive/availability; performing the restore = corrective
Directive sign	Deterrent sign	"Badge in before entry" vs. "Area under surveillance"
Compensating control	Just another preventive control	Compensating only when it substitutes for a required control you can't implement