Control Attributes and Risk Treatment Effects

Why this note exists

Control attributes are useful only if they help link a control to the risk treatment outcome you need.

A control should not be selected because it is popular, cheap, or easy. It should be selected because its effect on risk matches the desired outcome.

Desired risk effect	Better control type
Reduce likelihood	Preventive control
Improve detection	Detective control
Reduce impact	Corrective, recovery, containment, or resilience control
Improve accountability	Governance, approval, logging, segregation, review
Improve compliance	Policy, procedure, evidence, monitoring, legal/contractual controls

Control	Type	Effect
Security awareness	Preventive	Reduces likelihood of user-triggered compromise
Email filtering	Preventive/detective	Blocks or flags malicious messages
Patch management	Preventive	Reduces exploitability
EDR	Detective/respond	Detects suspicious activity and supports containment
Network segmentation	Preventive/limiting	Reduces spread
Immutable backups	Recovery	Reduces impact and supports restoration
Incident response playbook	Corrective/respond	Reduces confusion and response time
Disaster recovery testing	Recovery/resilience	Confirms ability to restore operations

Claimed risk treatment	Selected control	Problem
Prevent unauthorized access	Logging only	Logging detects; it does not prevent access
Prevent ransomware	Backup only	Backup recovers; it does not prevent infection
Ensure secure development	Policy only	Policy needs standards, review, testing, and enforcement
Reduce supplier breach risk	NDA only	NDA does not prove supplier security capability
Prevent insider misuse	Annual training only	Need access control, monitoring, segregation, and reviews

For every control, ask:

What risk does this control treat?
Does it reduce likelihood, detect occurrence, reduce impact, or support recovery?
Is that the outcome we actually need?
What evidence proves it operates?
Is another control needed to cover another part of the risk?

Aliases: Risk Treatment Effects

Source: 01 Fundamentals/Control Attributes and Risk Treatment Effects.md