Control Layers: Administrative, Technical and Physical

A control changes the likelihood, consequence or detection of an event; its label alone does not establish its effect. Administrative controls include access policy, ownership, training, review and approval. Technical controls include session settings, encryption, alerts and automated permission checks. Physical controls include locks, room access and environmental protection. One control can serve several purposes: an electronic server-room lock can deter unauthorized entry and produce an entry record. Multiple layers still do not cover every path. Name the path each layer blocks or reveals and a different path that remains possible.

Begin with a concrete scenario rather than a product purchase. When a receptionist leaves a terminal open on a personal roster, someone can view the screen or use the session before it expires. 'Lock the screen when leaving' is an administrative rule; a tested idle lock is technical; turning the display away from the corridor and limiting entry are physical measures. Do not place all prevention on a distracted individual. Conversely, an idle timer does not replace least privilege: an employee present at the terminal may still see data beyond the job's need. Measure each relevant path: attempted use after the timer, sight from the public corridor and privileges of the account opening the roster.

Preventive, detective and corrective describe effects, not product categories. A session lock prevents later use. An access record may reveal an attempt or aid investigation. Disabling an exposed account or restoring a correct file can correct a specific consequence. A record nobody reviews, or an alert that reaches nobody responsible, is weak detection. Name who receives the signal, when they should act and how to tell that it belongs to the scenario. If a test fails, distinguish a failed safeguard from failed evidence: did the action succeed, was it blocked without a record, or was it recorded without escalation?

Track the control after deployment. A one-minute idle timer that prevents reception work may push staff toward a shared session; test a workable interval instead of abandoning the safeguard. Examine exceptions too: a public status-only display needs different design from an employee terminal. Choose repeatable checks: fields visible to the reception role, time to lock and visibility from the visitor position. This training does not attribute a specific timer or policy to a certification issuer; the numbers are for a local tradeoff and verification exercise.