Definition
A preventive control is a security measure designed to stop a threat from occurring in the first place. It acts as a barrier or safeguard, proactively blocking unauthorized access or malicious activity before it can impact a system or data. These controls are implemented to reduce risk by preventing security incidents from happening. For example, strong password policies and multi factor authentication are preventive controls that stop unauthorized users from gaining access. Unlike detective controls, which identify incidents after they have occurred, preventive controls aim for outright prevention. Understanding preventive controls is crucial for cybersecurity professionals and is covered on exams like CompTIA Security+ and CISSP.