Cybersecurity control domains explained
Control domains are how the security world organises the very large number of things an organisation might do into categories that can be reasoned about. Access control, asset management, incident response, business continuity, supplier management and so on — each domain groups related controls so that coverage and gaps become visible.
What this session covers
- Controls are commonly classified by function: preventive (stop it happening), detective (notice it happened) and corrective (put it right afterwards).
- They are also classified by type: technical, administrative and physical.
- Frameworks differ in how they slice the domains, but the underlying controls overlap heavily — ISO 27001, NIST CSF, NIST 800-53 and the CIS Controls all cover much of the same ground.
- A control matrix that maps your controls once and then cross-references them to each framework saves an enormous amount of duplicated effort.
A balanced control set covers all three functions. Organisations that over-invest in prevention and under-invest in detection tend to find out about incidents from someone else — a customer, a regulator or an attacker.
For a GRC analyst, the practical value of domains is coverage analysis. Laying your controls out by domain makes it immediately obvious where you have five overlapping controls and where you have none at all.
Go further with mentorship
This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation.