Configuration controls include using methods such as vulnerability scans and patch management systems, which reduce the likelihood that attackers will succeed in identifying weaknesses to exploit. Access controls include tools such as firewalls, intrusion prevention systems, physical access controls, and authentication and authorization procedures, which are
used to reduce the likelihood of an attacker successfully obtaining unauthorized access to a system.
Monitoring controls include documentation and log analysis, which function to detect problems and provide
information necessary for remediation.5