Which measure is a preventive measure?

A preventive measure is a control designed to avoid an incident before it can occur. Putting sensitive information in a safe is a physical security control that proactively prevents unauthorized individuals from accessing it. This action directly stops a potential security breach. The other options are reactive: a logging system is a detective control that identifies an event after it has happened, and shutting down traffic is a corrective action taken in response to an incident that is already underway or has occurred.

A. This is a detective control. A logging system records events as they happen, allowing for later detection and analysis, but it does not prevent the initial action.

B. This is a corrective/responsive control. This action is taken after a security incident (hacker access) has been identified to mitigate further damage.

1. NIST Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations" (December 2020).

Section 2.3, Page 10: This document categorizes security controls by function. It defines preventive controls as those that "inhibit attempts to violate security and privacy policies and include controls such as access control enforcement." A safe is a form of access control. It defines detective controls as those that "warn of violations or attempted violations," with examples including audit trails (logging). Corrective controls are defined as those that "provide a means to repair or restore a system to a state prior to a harmful event," which aligns with incident response actions like shutting down traffic.

2. Peltier, T. R. (2013). Information Security Fundamentals (2nd ed.). CRC Press.

Chapter 4, "Risk Management," Section "Control Types," Page 65: This academic text, widely used in university curricula, classifies controls. It states, "Preventive controls are deployed to prevent a potential security event from occurring." It explicitly lists "locks on doors" and "safes" as examples of preventive physical controls. It contrasts this with detective controls (e.g., "audit trails") and corrective controls (e.g., "incident response").

3. University of California, Berkeley, Security Policy (IS-3).

Section "Control Standards," Subsection "Control Categories": The university's official information security policy, a form of institutional documentation, defines control categories for its ISMS. It describes Preventive Controls as those that "prevent errors, omissions, or security incidents." It defines Detective Controls as those that "detect errors or incidents that have occurred," and Corrective Controls as those that "correct errors or incidents after they have been detected." This framework clearly places a safe in the preventive category.