Which of the following best describes a preventive control?
A control that substitutes for a primary control when it is not feasible or practical to implement.
A control that stops a security incident or attack from happening before it can cause harm.
A control that directs the actions of individuals or systems to maintain security.
A control that identifies and responds to security incidents after they have occurred.