Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental…

Encryption and access-control mechanisms are classified by their function (preventive—they stop unauthorized disclosure or use before it occurs) and by their nature (technical—implemented in hardware, firmware, or software and therefore called logical controls). When a security control is both technical and designed to prevent an unwanted event, it is termed a Preventive/Technical control.

A. Administrative controls are policy, procedure, or people driven, not encryption or OS-level access checks.

C. Physical controls are tangible barriers (locks, guards); encryption and logical ACLs are non-physical.

D. Detective controls signal that an event has happened (e.g., audit logs); encryption and access control act before the violation, not after.

1. (ISC)²

SSCP Systems Security Certified Practitioner Official CBK

3rd ed.

2019

Chapter 3 “Security Controls”

pp. 94-96 – defines technical (logical) controls and lists encryption & access control as preventive.

2. NIST Special Publication 800-12 Rev.1

“An Introduction to Information Security

” Sect. 3.3.2 & Table 3-1

pp. 3-8–3-9 – classifies security controls by type (technical) and function (preventive).

3. NIST SP 800-53 Rev.5

“Security and Privacy Controls

” Appendix C

Control Families AC and SC – describes Access Control (AC) and System & Communications Protection (encryption) as technical preventive measures.