The controls that usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists are associated with:

The controls described, such as sensors and cameras, are tangible objects that exist in the physical world, classifying them as physical controls. Their primary function in this scenario is to monitor an environment and alert personnel to a potential threat, which is a detective function. The requirement for a human to evaluate the data from these devices to confirm a threat solidifies this classification. The system is designed to detect and report an event, not to prevent it from happening initially.

A. Preventive/physical: This is incorrect because the function described is detecting a potential threat, not preventing it. A preventive physical control would be a fence or a locked door.

B. Detective/technical: This is incorrect because while the function is detective, cameras and sensors are categorized as physical controls, not technical (or logical) controls like an Intrusion Detection System (IDS) or firewall logs.

D. Detective/administrative: This is incorrect because the controls themselves (sensors, cameras) are physical devices. Administrative controls are policies, procedures, and guidelines, such as the procedure for a guard to follow when an alarm is triggered.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. The "Physical and Environmental Protection" (PE) control family details controls like surveillance equipment. Specifically

control PE-6 (Monitor Physical Access) describes the use of surveillance systems to "monitor and record physical access to the facility where the system resides." This is a physical control with a detective function. (See Appendix F

Control Family: PE).

2. Hernandez

S. (2021). Official (ISC)² Guide to the SSCP CBK

5th Edition. Sybex. Chapter 1

"Security Operations and Administration

" defines the categories of security controls. It classifies controls by type (physical

technical

administrative) and by function (preventive

detective

corrective). CCTV cameras and motion sensors are provided as examples of physical controls

and their use for monitoring is described as a detective function. (See Chapter 1

"Understand and Apply Security Concepts

" Section: "Control Types").

3. Harris

S.

& Maymi

F. (2022). CISSP All-in-One Exam Guide

9th Edition. McGraw-Hill. While a CISSP resource

the fundamental security concepts are identical to SSCP. Chapter 1

"Security and Risk Management

" clearly defines control types. It states

"CCTV is a detective physical control... It doesn't prevent access

but it can detect unauthorized access and record it for later review." (See Chapter 1

"Security Controls

" Section: "Control Types").