Security controls

Q: What are the three main operational categories of security controls used to protect the CIA triad?

Security controls are grouped into physical controls (tangible barriers), logical/technical controls (hardware and software mechanisms), and administrative/procedural controls (management policies and rules).

Q: What are the five functional classifications of security controls based on when and how they act?

The five functional classifications are deterrent , preventive , detective , corrective , and recovery controls.

Q: What is the fundamental difference between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared key to both encrypt and decrypt data, whereas asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt.

Q: What is the difference between identification and authentication, and how is Multi-Factor Authentication (MFA) achieved?

Identification is claiming an identity, while authentication is proving it; MFA requires combining two or more distinct factors across knowledge, possession, or inherence.

Q: What distinguishes General IT Controls (GITCs) from Application Controls?

General IT Controls secure the overarching IT environment and infrastructure, while Application Controls are embedded within specific software to ensure data validity and processing accuracy.

Q: What are the five systematic steps for developing cyber risk responses in an organization?

The five steps are: risk assessment , response formulation , control design , implementation and integration , and monitoring and review .

Q: What is the principle of least privilege, and why is relying solely on technological controls a critical governance mistake?

The principle of least privilege restricts user access strictly to the minimum data and systems necessary for their role, protecting against human error and social engineering that bypass technology.

P3 – Risk Management · CIMA (CGMA Professional Qualification) · 7 min read · Updated: 6 Nov 2026

Welcome to the World of Security Controls!

Welcome, fellow CIMA students! We are currently exploring Section D: Cyber Risk of your P3 Risk Management syllabus. This specific chapter, Security Controls, is all about the "defense" side of the game. Now that we know what cyber threats are out there, how do we actually stop them?

Think of security controls as the various layers of protection around a bank vault. Some are there to scare people off, some stop people from getting in, and some tell you when someone has broken in. Don't worry if this seems a bit technical—we are going to break it down using everyday examples to make it stick!

1. What are Security Controls?

In simple terms, a security control is any measure taken to reduce the risk of a cyber threat. The goal is to protect the Confidentiality, Integrity, and Availability (CIA) of data.

We generally group these controls into three main "buckets":

1. Physical Controls: These are things you can touch. They protect the physical environment.
Example: Locks on doors, CCTV, or security guards.

2. Logical (Technical) Controls: These are software or hardware settings that protect data inside the systems.
Example: Passwords, firewalls, and encryption.

3. Administrative (Procedural) Controls: These are the "rules" and policies set by management.
Example: Employee training, background checks, and security policies.

Quick Review Box

Question: Is a "Clear Desk Policy" a physical or administrative control?
Answer: It is Administrative, because it is a rule or procedure employees must follow.

2. Classifying Controls by Function

This is a favorite topic for examiners! Controls aren't just categorized by what they are, but by what they do. To remember these, think of the timeline of a crime.

A. Deterrent Controls

These are designed to discourage someone from attempting an attack in the first place. They play on the psychology of the attacker.
Analogy: A sign that says "Beware of the Dog." There might not even be a dog, but it makes the burglar think twice!

B. Preventive Controls

These are the "walls" that actually stop an attack from being successful. They block unauthorized access.
Analogy: A high-quality deadbolt lock on your front door.

C. Detective Controls

These identify that an attack is happening or has already happened. They don't stop it, but they sound the alarm.
Analogy: A smoke detector or a motion-sensor alarm.

D. Corrective Controls

These help fix the damage after an incident has occurred and restore systems to normal.
Analogy: An automatic fire sprinkler system that puts out the fire once it's started.

E. Recovery Controls

These go a step further than corrective controls by restoring the system to its original state, often using backups.
Analogy: Using your insurance payout to rebuild your house after a fire.

Memory Aid: "D-P-D-C-R"

Think: Dogs Protect Doors, Cats Run.
(Deterrent, Preventive, Detective, Corrective, Recovery)

3. Key Logical (Technical) Controls

Since we are in the Cyber Risk section, we need to focus on the technical tools used to keep hackers at bay. Don't let the jargon scare you!

Encryption

Encryption turns readable data (plain text) into a scrambled mess (cipher text) that can only be read if you have the "key."

- Symmetric Encryption: Both the sender and receiver use the same key to lock and unlock the data. It's fast, but you have to find a way to share the key securely.
- Asymmetric Encryption: Uses a Public Key (which anyone can use to lock the data) and a Private Key (which only the owner has to unlock it). It's like a mailbox where anyone can drop a letter in, but only the owner has the key to open it.

Firewalls

A firewall acts as a "bouncer" between your internal network and the internet. It inspects incoming and outgoing traffic and decides whether to let it through based on a set of rules.

Access Controls: Identification vs. Authentication

Many students confuse these two. Let's clear it up:
- Identification: Claiming who you are (e.g., typing your username).
- Authentication: Proving who you are (e.g., entering your password or scanning your fingerprint).

Multi-Factor Authentication (MFA): This is when you use two or more ways to prove your identity. It usually combines:
1. Something you know (a password).
2. Something you have (a code sent to your phone).
3. Something you are (your fingerprint or face scan).

4. General Controls vs. Application Controls

CIMA examiners love testing the difference between these two categories. This is vital for understanding how IT systems are audited.

General IT Controls (GITCs)

These apply to the entire IT environment. They make sure the whole "house" is safe.
Examples: Physical security of the server room, password policies for all employees, and disaster recovery plans.

Application Controls

These are specific to a particular software application (like your payroll system or accounting software). They ensure the data processed by that specific program is accurate and complete.
Examples:

Input Controls: Checks that ensure data entered is valid (e.g., you can't enter a negative number for an employee's salary).
Processing Controls: Checks that ensure the math is done correctly (e.g., total debits must equal total credits).
Output Controls: Checks that ensure the reports go to the right people.

Key Takeaway Summary

General Controls are about the infrastructure (The whole building).
Application Controls are about the data within a specific task (The filing cabinet inside one room).

5. Developing Responses to Assessed Risks and ISO 27001

In P3, security controls are not implemented randomly. Organisations must follow a systematic process for developing responses to assessed risks and align them with international standards.

Process for Developing Risk Responses

1. Risk Assessment: Identify the entity's sensitive data, systems, and threat landscape, evaluating vulnerabilities against likelihood and impact.
2. Response Formulation: Determine the appropriate mitigation strategy (avoid, reduce, transfer, accept) in line with organisational risk appetite.
3. Control Design: Design specific preventive, detective, and corrective controls that directly target the identified vulnerabilities.
4. Implementation and Integration: Deploy controls across physical, technical, and administrative operational workflows.
5. Monitoring and Review: Continuously review control performance and system outputs to update controls as threats evolve.

Aligning Controls with ISO 27001

ISO 27001 is the internationally recognised standard for information security management systems (ISMS). In the CIMA P3 exam, you are expected to recommend cybersecurity responses that comply with ISO 27001 requirements:

- Risk-Driven Approach: ISO 27001 requires organisations to select and implement security controls directly derived from a formal risk assessment rather than adopting a generic checklist.
- CIA Objectives: Controls must comprehensively protect the confidentiality, integrity, and availability of information assets.
- Comprehensive Control Sets: The standard prescribes controls spanning organisational policies, people security, physical security, and technological safeguards.
- Continuous Improvement: An ISO 27001-compliant response incorporates routine audits, leadership oversight, and corrective actions to ensure controls adapt to emerging cyber vulnerabilities.

6. Common Mistakes to Avoid

- Thinking technology is enough: Most cyber breaches happen because of human error. This is why Administrative Controls (training) are just as important as Logical Controls (firewalls).
- Mixing up Detective and Preventive: If a control stops the event from happening, it's Preventive. If it just tells you that it's happening, it's Detective.
- Overlooking "Least Privilege": This is the principle that employees should only have access to the data they absolutely need for their job. Giving everyone "Admin" access is a major risk!
- Ignoring Standards like ISO 27001: Implementing technical tools without an overarching framework like ISO 27001 leaves gaps in risk governance and control design.

Did you know?

The "weakest link" in most security systems isn't a computer bug; it's Social Engineering. This is when hackers trick people into giving away passwords or clicking links. This is why Cyber Security Culture and regular staff training are considered critical security controls in the P3 syllabus!

Final Thoughts for P3 Students

Don't worry if the technical side of cyber risk feels overwhelming at first. Just keep asking yourself: "What is this control trying to achieve? Is it stopping a threat, finding a threat, or fixing the mess after a threat? And does it align with an established standard like ISO 27001?" Once you can answer that, you've mastered the heart of this chapter!

References

Strategic Level Examination Blueprint 2026-2027 — AICPA & CIMA

Quick check

Can you answer these now?

Open each question to check the key ideas from this chapter.

What are the three main operational categories of security controls used to protect the CIA triad?

Security controls are grouped into physical controls (tangible barriers), logical/technical controls (hardware and software mechanisms), and administrative/procedural controls (management policies and rules).

What are the five functional classifications of security controls based on when and how they act?

The five functional classifications are deterrent, preventive, detective, corrective, and recovery controls.

What is the fundamental difference between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared key to both encrypt and decrypt data, whereas asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt.

How does a firewall safeguard an organization's network?

A firewall filters incoming and outgoing network traffic by applying predefined security rules to block unauthorized or malicious transmissions.

What is the difference between identification and authentication, and how is Multi-Factor Authentication (MFA) achieved?

Identification is claiming an identity, while authentication is proving it; MFA requires combining two or more distinct factors across knowledge, possession, or inherence.

What distinguishes General IT Controls (GITCs) from Application Controls?

General IT Controls secure the overarching IT environment and infrastructure, while Application Controls are embedded within specific software to ensure data validity and processing accuracy.

What are the five systematic steps for developing cyber risk responses in an organization?

The five steps are: risk assessment, response formulation, control design, implementation and integration, and monitoring and review.

How does aligning security controls with ISO 27001 enhance an organization's Information Security Management System (ISMS)?

ISO 27001 provides a structured, risk-driven framework covering people, processes, and technology to systematically protect the CIA triad and ensure continuous improvement.

What is the principle of least privilege, and why is relying solely on technological controls a critical governance mistake?

The principle of least privilege restricts user access strictly to the minimum data and systems necessary for their role, protecting against human error and social engineering that bypass technology.

Ready to test yourself?

Turn these notes into exam-style practice. Get unlimited AI questions on this topic with instant marking and explanations.

Practise This Topic

More P3 – Risk Management chapters

* The content provided by thinka is generated by AI and may not always be accurate or up-to-date. Please use it as a supplementary resource and verify with official materials.

Put These Notes into Practice

Reading the notes is a great start. Now practise with unlimited AI-generated questions and get instant feedback. 100,000+ students are already improving their grades.

Start Practising Now View Pricing

Done reading? Test yourself with AI practice questions

Practise This Topic Now