1.4 Control Taxonomy and Functional Classification

1.4 Control Taxonomy and Functional Classification

In an Information Security Management System (ISMS), controls are the safeguards, policies, procedures, mechanisms, and countermeasures deployed to modify risk. ISO/IEC 27001 Clause 6.1.3 requires organizations to select controls based on their risk treatment process and compare them against the reference controls in Annex A. To audit, design, or implement controls effectively, Lead Auditors must master control taxonomy—the systematic classification of controls by function, implementation domain, and operational attributes.

---

Functional Control Classification

Functional classification categorizes controls by when and how they act relative to a security incident:

Incident Timeline:
-------- Before Incident --------|---- During Incident ----|-------- After Incident --------
     [ PREVENTIVE CONTROLS ]     |  [ DETECTIVE CONTROLS ] |     [ CORRECTIVE CONTROLS ]
  Stop threat from materializing |  Identify active breach |  Remediation & restoration

1. Preventive Controls

• Objective: Proactively prevent an unwanted security event, incident, or unauthorized access from occurring.
• Mechanism: Acts as a barrier or restriction prior to threat exploitation.
• Examples: Multi-factor authentication (MFA), firewall block rules, mandatory security awareness training, physical door locks, biometric access gates, pre-employment background checks.
• Audit Value: High efficiency; stopping an incident before execution eliminates direct recovery costs.

2. Detective Controls

• Objective: Identify, discover, and alert on unauthorized activities, policy violations, or security incidents as they occur or shortly thereafter.
• Mechanism: Monitors system behavior, events, or logs against baseline anomalies or signature patterns.
• Examples: Security Information and Event Management (SIEM) alerts, Intrusion Detection Systems (IDS), log reviews, security audits, file integrity monitoring (FIM), motion detectors, CCTV surveillance.
• Audit Value: Crucial for visibility; without detective controls, an organization cannot determine if preventive controls have failed.

3. Corrective Controls

• Objective: Remediate damage, restore operations, isolate compromised systems, and correct errors following a security incident.
• Mechanism: Takes reactive measures to limit impact and bring systems back to a secure operational state.
• Examples: Automated system patch deployment, virus/malware quarantine routines, database backup restoration, disaster recovery failover, incident response playbook execution.
• Audit Value: Mitigates impact severity after a breach has occurred.

---

Implementation Classification (Domains)

Controls are also classified by their implementation nature or operational domain:

---

ISO/IEC 27002:2022 Control Attributes Taxonomy

ISO/IEC 27002:2022 modernized control management by assigning 5 standardized attribute values to each of the 93 controls. This enables automated filtering, tagging, and cross-mapping across frameworks:

1. Control Type: #Preventive, #Detective, #Corrective
2. Information Security Properties: #Confidentiality, #Integrity, #Availability
3. Cybersecurity Concepts: #Identify, #Protect, #Detect, #Respond, #Recover (aligned with NIST CSF)
4. Operational Capabilities: #Governance, #Asset_management, #Information_protection, #Human_resource_security, #Physical_security, #System_and_network_security, #Application_security, #Threat_and_vulnerability_management, #Identity_and_access_management, #Continuity, #Supplier_relationships, #Legal_and_compliance, #Information_security_event_management
5. Security Domains: #Governance_and_Ecosystem, #Protection, #Defense, #Resilience

---

Defense-in-Depth and Compensating Controls

Defense-in-Depth Architecture

No single security control is foolproof. Defense-in-depth is the practice of layering multiple, redundant control classifications across different domains so that if one control fails, subsequent controls prevent systemic compromise.

Example: Protecting sensitive database records relies on:

1. Physical security locks on data center doors (Physical Preventive)
2. Firewall access control lists (Technical Preventive)
3. Database user access permissions (Administrative & Technical Preventive)
4. SIEM database audit logging (Technical Detective)
5. Daily encrypted backups stored off-site (Technical Corrective)

Compensating Controls

A compensating control is an alternative safeguard implemented when a primary control recommended by ISO/IEC 27002 cannot be technically or economically implemented.

• Audit Requirement: The Lead Auditor must verify that the compensating control achieves the exact same security objective and provides an equivalent risk reduction compared to the standard primary control.

---

Lead Auditor Verification of Controls

During an ISMS audit, Lead Auditors evaluate controls across two distinct dimensions:

1. Design Suitability (Design Effectiveness): Is the control appropriately designed to prevent, detect, or correct the specific risk for which it was chosen?
2. Operational Effectiveness: Is the control operating as intended consistently over the audit period, and is it executed by competent personnel?

An auditor will test controls using four standard methods: Inquiry (interviewing staff), Observation (watching control execution), Inspection (reviewing documented evidence/logs), and Re-performance (independently executing the control procedure).