What is a directive control?
A directive control states required behavior and depends on people to follow it. It doesn't enforce anything on its own. Policies, standards and procedures, the acceptable use policy (AUP), non-disclosure agreements, a code of conduct, security awareness training and instructional signs are all directive. They are cheap, they cover situations no technical control anticipated, and they give the organization a basis for discipline when someone breaks the rule.
Examples of directive controls
Directive is a control type, so it shows up in every control category:
| Control | Category | What it directs |
|---|---|---|
| Acceptable use policy | Managerial | How staff may use company systems, email and internet access |
| Data handling procedure | Managerial | How to label, store and dispose of sensitive data |
| Security awareness training | Operational | How to spot and report phishing |
| "Authorized personnel only" sign | Physical | Who may enter a room |
| Logon notice listing usage rules | Technical | What users agree to when they sign in |
Directive controls need backing
A directive control works only as well as people's willingness and ability to follow it. A policy that says "Do not store customer data in personal cloud accounts" is directive. A web proxy rule that blocks uploads to those services is preventive. Both serve the same rule, and organizations usually pair them: the policy sets the expectation and gives HR grounds for action, the proxy rule enforces it, and a DLP alert catches cases that slip past both. A useful test is whether someone could ignore the control and still succeed. If they could, the control isn't preventive.
Directive controls also need upkeep. A policy nobody has read, or a procedure that no longer matches how the work is done, directs nothing. Staff typically acknowledge the AUP at hiring and again on a regular schedule, and procedures are updated through change management when systems change.
Directive vs. deterrent
Both rely on human choice, so they blur. A directive tells people what to do; a deterrent warns them what will happen if they misbehave. "Authorized personnel only" is directive, while "Trespassers will be prosecuted" is deterrent. A sanctions policy that lists penalties is deterrent, while the AUP that sets the rules is directive. Training is another edge case: it instructs people, so it is directive, though some sources call it preventive because trained staff fall for fewer phishing emails. If both appear as options, check whether the question stresses instruction or an attack being stopped.
Directive control on the CompTIA Security+ exam
Directive is one of the six control types in SY0-801 objective 1.1. Words such as policy, must, required, instruct, mandate and guidance point to directive. The usual distractors are preventive, when the scenario also mentions a technical block, and deterrent, when it mentions consequences. Read which control the question asks about. In a scenario where the company bans personal cloud storage and configures the proxy to block those sites, the ban is directive and the proxy rule is preventive. Keep type and category separate: a directive control can be managerial, operational, physical or technical.