What is a technical control?
A technical control is a safeguard that a system enforces. Once someone configures it, the hardware, software or firmware applies it to every request without a person deciding each case. Security+ sorts every control into one of four categories by how it is carried out: technical, managerial, operational and physical. Technical controls are the category most people picture when they think of security tools, and many texts also call them logical controls.
Examples of technical controls
- Firewall rules, router access control lists and network segmentation
- Encryption of data at rest and in transit
- Multifactor authentication, password policies and account lockout settings
- File, share and application permissions
- EDR and antivirus agents, host firewalls and application allow lists
- Intrusion detection and prevention, data loss prevention, web and email filtering
- Audit logging, SIEM correlation rules and file integrity monitoring
- Automated backups and patch deployment
Who configured it doesn't decide the category
A common mistake is to call a control operational because an administrator set it up. The category depends on what enforces the rule at the moment it matters. Suppose an administrator sets an account lockout threshold of 10 invalid attempts in a domain Group Policy. When an attacker's tenth wrong password arrives at 3 a.m., no person is involved: the domain controller locks the account and records event ID 4740. That is a technical control, and the same reasoning covers a firewall rule an engineer wrote or a conditional access policy the CISO approved.
Electronics alone don't make a control technical either. A badge reader on a server room door runs firmware, but it protects entry to a room, so it is physical. A fingerprint reader that unlocks a laptop protects logical access to the operating system, so it is technical.
Strengths and limits
Technical controls are consistent, fast and good at producing records. They apply the same rule at any hour and at a scale no staff could match. Their weakness is that they do exactly what they were told. A rule permitting TCP 3389 from any source lets attackers reach RDP, and the firewall reports that it is working normally. That is why technical controls sit under managerial oversight, such as policy, change approval and periodic review, and beside operational work such as daily alert triage.
Technical category vs. control type
Category and type are separate labels, and every control gets both. The category says how the control is implemented; the type says what it does around an incident: preventive, deterrent, detective, corrective, compensating or directive. Technical controls appear in every type:
- MFA on the VPN: technical and preventive
- SIEM alert for impossible travel: technical and detective
- Restoring encrypted files from backup: technical and corrective
- Login banner warning that activity is monitored: technical and deterrent
Technical control on the CompTIA Security+ exam
Control categories belong to SY0-801 objective 1.1. A question describing something a system enforces automatically, such as a setting, rule, agent, policy object or encryption, points to technical, and the word logical means the same thing. Typical distractors are managerial, when the stem also mentions the written policy behind the setting; operational, because a person configured it; and physical, when a device contains electronics but protects a space. If a question asks which control enforces a written rule, choose the technical control; the rule itself is managerial.