Controls
Preventive vs detective
Whether a control stops something happening or notices that it did. The distinction changes how materiality treats a failure.
What they are
A preventive control stops something. A detective control notices it.
Public access restrictions and encryption requirements are preventive. Audit logging and threat detection coverage are detective.
Why the distinction is recorded
Because materiality treats them differently, and should.
A critical preventive control whose concern is reachable from outside is escalated one materiality band. An open door anyone can reach carries further than its resource count suggests.
A detective control is never escalated by severity. A missing alarm is a visibility gap, not an open door, and inflating it would make the band meaningless where it matters.
How GovIntel applies it
The class is recorded in the governance mapping, per category, alongside reachability and the typical owning role.
What it does not mean
Detective controls are not less important. They are differently important, and conflating the two is what the distinction exists to prevent.