Security controls are measures put in place to protect information and systems from threats. They can be physical, like locks and surveillance cameras, or digital, such as firewalls and encryption. These controls help ensure the confidentiality, integrity, and availability of data, making it harder for unauthorized users to access sensitive information. Organizations implement security controls based on risk assessments to determine what is necessary for their specific environment. Common types of security controls include preventive controls, which stop incidents before they happen, detective controls, which identify incidents as they occur, and corrective controls, which help recover from incidents after they happen.