Which security control role does encryption meet?

Encryption is classified as a preventative control because it protects data confidentiality by rendering information unreadable to anyone without the correct decryption key, acting before a security incident causes harm. Even if encrypted data is intercepted or stolen, it cannot be leveraged by an attacker, meaning the harm is prevented rather than detected or corrected after the fact.

Detective controls identify and alert on incidents after they occur - such as IDS alerts or audit logs - whereas encryption does not detect or report unauthorized access attempts.

Offensive is not a recognized control category in standard frameworks such as NIST SP 800-53 or ISO 27001, which classify controls as preventative, detective, or corrective.

Defensive is not a formal control type in standard security control taxonomies - while encryption is broadly defensive in nature, its proper classification in frameworks like NIST and ISO is preventative.