A company security policy mandates education and training for new employees. The policy must outline acceptable use policies for SaaS applications. Given these requirements, which of the following…

Preventive controls aim to stop incidents from occurring in the first place, such as firewalls or access controls, though training also has a preventive aspect, the act of mandating a policy to outline correct use can also be seen as rectifying a lack of guidance.

Detective controls identify incidents that have occurred or are in progress, such as intrusion detection systems or security logs, which is not the primary purpose of outlining AUPs or training.

Corrective controls are designed to reduce the impact of an incident or rectify a condition. By mandating education and training on acceptable use policies, the company is actively correcting potential user behavior or knowledge gaps that could lead to security incidents, establishing correct practices to prevent future issues.

Physical controls restrict access to physical assets, like locks or security guards, and are unrelated to employee education and policy compliance.