Which control is primarily concerned with compliance and governance, enforcing rules via policy or contract?

Which control is primarily concerned with compliance and governance, enforcing rules via policy or contract?

• A. Deterrent
• B. Directive
• C. Compensating
• D. Preventive

Answer: (B)

Directive controls govern how people and systems should behave by defining rules and obligations and enforcing them through policy or contract. They establish authority, set expectations, and provide the basis for audits and compliance checks, ensuring actions align with laws, regulations, and organizational standards. Examples include security policies, acceptable-use policies, data handling rules, and contractual obligations with vendors. Because governance and compliance hinge on having formal rules that must be followed and verified, these controls are inherently policy-driven and contract-backed, making them the primary mechanism for enforcing rules at an organizational level. Deterrent controls aim to discourage violations through penalties or the threat of punishment, rather than actively enforcing policy through formal rules. Preventive controls focus on stopping unauthorized actions before they occur, such as technical access controls or physical security measures, rather than governing behavior through policy. Compensating controls provide alternative measures when primary controls aren’t feasible, but they don’t establish governance rules themselves. In the context of compliance and governance, directive controls best fit as the vehicle for enforcing rules via policy or contract.

Directive controls govern how people and systems should behave by defining rules and obligations and enforcing them through policy or contract. They establish authority, set expectations, and provide the basis for audits and compliance checks, ensuring actions align with laws, regulations, and organizational standards. Examples include security policies, acceptable-use policies, data handling rules, and contractual obligations with vendors. Because governance and compliance hinge on having formal rules that must be followed and verified, these controls are inherently policy-driven and contract-backed, making them the primary mechanism for enforcing rules at an organizational level.

Deterrent controls aim to discourage violations through penalties or the threat of punishment, rather than actively enforcing policy through formal rules. Preventive controls focus on stopping unauthorized actions before they occur, such as technical access controls or physical security measures, rather than governing behavior through policy. Compensating controls provide alternative measures when primary controls aren’t feasible, but they don’t establish governance rules themselves. In the context of compliance and governance, directive controls best fit as the vehicle for enforcing rules via policy or contract.