[Verse 1] Before the storm can hit your door Preventive controls stand guard Access lists and duties split Background checks pull every card Input validation at the gate Encryption keeps your data safe Stop the breach before it starts That's the preventive way [Chorus] Prevent before, detect during Correct the mess, compensate when you're hurting Deter with fear, recover clear Five controls to make threats disappear P-D-C-C-D, that's your security key Management controls in harmony [Verse 2] When something slips through your defense Detective controls will see Monitoring logs around the clock Intrusion systems on duty Reconcile what doesn't match Audit trails show every track Find the problem as it happens That's detection's guarantee [Chorus] Prevent before, detect during Correct the mess, compensate when you're hurting Deter with fear, recover clear Five controls to make threats disappear P-D-C-C-D, that's your security key Management controls in harmony [Verse 3] After detection sounds the bell Corrective action takes the stage Incident response kicks in gear Patches deployed to turn the page Restore from backup, discipline too Fix what broke and make it new Remediate within the time That's correction's proper wage [Bridge] When primary controls can't be done Compensating steps in as the one Alternative measures, equivalent might Enhanced logging plus network sight Deterrent warns of consequence Awareness training, common sense Recovery brings you back to start Clean slate with a beating heart [Chorus] Prevent before, detect during Correct the mess, compensate when you're hurting Deter with fear, recover clear Five controls to make threats disappear P-D-C-C-D, that's your security key Management controls in harmony [Outro] From policy language you can tell Which control type serves you well "Shall prevent" and "access restrict" "Monitor close" and "incidents fix" Classification by function Your security's conjunction
← 3 The Relationship Between Controls and Policy | 2 Classification by Nature →