An organization needs to determine how many employees are accessing the building each day in order to configure the proper access controls. Which of the following control types best meets this requirement?

A detective control aims to identify and record an incident after it has occurred. In this scenario, counting employees accessing the building is a detective control because it monitors and records activity to determine the number of entries, rather than preventing or correcting an issue. Preventive controls stop an incident from happening (e.g., a locked door). Corrective controls fix an issue after it has been detected (e.g., revoking access after unauthorized entry). Directive controls specify actions or behaviors (e.g., security policies). The act of counting accesses is purely for detection and analysis, fitting the definition of a detective control.