City council issues a binding directive that all departments must encrypt laptops. Which control type best describes that mandate?
Select an answer to reveal the explanation.
Short Explanation
A council directive is the boss saying 'you will do this' — it tells people what behavior is required. That is a directive control type. The disk encryption software that actually scrambles the drive is a separate technical/preventive story.
Full Explanation
Directive controls mandate or prescribe required actions and behaviors, typically through policies, standards, ordinances, or other authoritative instructions. A binding city-council directive that all departments must encrypt laptops is directive because it tells departments what they are required to do. The mandate's type is about prescribing behavior; full disk encryption technology that later lands on endpoints is a separate preventive/technical implementation.
Calling the mandate detective because encryption "discovers stolen laptop contents" misunderstands both directive and detective types. Detective controls identify and alert on activity; encryption protects confidentiality of data at rest and does not, by itself, discover theft. Labeling the directive compensating because "directives always replace missing technical controls" is false: compensating controls are alternate mitigations when a preferred control is not yet feasible, and a council mandate is not automatically a compensating substitute. Framing the ordinance as corrective because it "repairs already-stolen devices" mismatches corrective remediation after an incident; a forward-looking encryption requirement does not rebuild compromised systems.
Exam caveat: distinguish the directive (must encrypt) from the technical preventive control (BitLocker/FileVault deployment). SY0-701 may ask for the type of the mandate specifically.
Operational check: translate the council directive into a municipal standard with scope, exceptions, and deadlines; track endpoint encryption compliance; pair the directive with technical enforcement and operational support for users who lose recovery keys—so the mandate becomes measurable security outcomes, not only legal language.