Security concepts & principles
Security Controls & Policies
Overview
Security controls are the safeguards themselves — administrative, technical, or physical — and security policies are the formal rules that define how those controls get applied.
Key concepts
- Administrative vs. technical vs. physical controls
- Common policy types
- Policies need real technical backing to matter
How it works
Security controls are safeguards used to protect systems, networks, facilities, users, and data — reducing risk by preventing, detecting, responding to, or recovering from security incidents. They fall into three major categories.
| Category | What it covers | Examples |
|---|---|---|
| Administrative | Policies, procedures, standards, training, and management practices. | Acceptable-use policies, security-awareness training, background checks, IR plans, change-management procedures, data-classification policies. |
| Technical | Technology used to enforce security requirements. | Firewalls, encryption, MFA, endpoint protection, VPNs, antivirus, IDS/IPS, vulnerability scanners, ACLs, SIEM tools. |
| Physical | Protecting people, facilities, equipment, and media from unauthorized access or damage. | Locks, fences, security guards, key cards, cameras, alarms, locked server racks, fire suppression, shredders. |
A couple of concrete examples worth remembering: an acceptable-use policy (administrative) explains how users may and may not use organizational systems and internet access. Full-disk encryption on a laptop (technical) protects data if the device is lost or stolen. A locked network closet (physical) stops unauthorized people from unplugging equipment or connecting rogue devices.
Security policies
Security policies are formal rules explaining an organization's security expectations and responsibilities — defining how users must handle systems, accounts, devices, data, and security incidents.
| Common policy types |
|---|
| Acceptable use, password & MFA, access control, remote work, data classification, incident response, backup & recovery, bring-your-own-device (BYOD). |
Policies should be clear, regularly reviewed, communicated to users, and backed up by actual technical controls — a policy nobody enforces isn't really a control at all.