Preventive controls are designed to stop incidents from occurring in the first place. They are proactive measures implemented to prevent security breaches, unauthorized access, or other security incidents. Examples of preventive controls include firewalls, which control network traffic, and access controls, which restrict access to resources based on user roles and permissions. While other types of controls, such as detective controls (identifying incidents) and corrective controls (limiting damage after an incident), are important, they do not directly prevent incidents from happening.