Preventive security controls proactively stop unauthorized access before it occurs. The most effective method is strict access management, where new or additional access rights require formal validation before being granted.
Prevents Unauthorized Entry – Ensures that only approved personnel have access to the power plant.
Implements Segregation of Duties (SoD) – Supervisors validate access requests, reducing insider threats.
Aligns with Least Privilege Principle – Employees get only the minimum access necessary for their role.
Prevents Security Risks Before They Happen – Unlike detective or corrective controls, this method stops unauthorized access before it occurs.
A. Offboarding procedure (monthly review) – This is a detective control, identifying issues after access is granted, not preventing them.
B. Smart lock anomaly scanning – Also detective, as it identifies suspicious behavior after access has been used.
D. Automatic notifications for after-hours entry – A corrective control, responding to potential violations instead of preventing them.
IIA’s GTAG on Identity and Access Management – Recommends pre-approval processes for sensitive locations.
ISO 27001 Annex A.9 (Access Control) – Requires role-based access management for critical infrastructures.
NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) – Defines supervisor approval as a key preventive measure.
Why Approval-Based Access Control is the Best Preventive Measure?Why Not the Other Options?IIA References:
Submit