ISC2 Certified in Cybersecurity (CC)Security PrinciplesMedium
A company is reviewing its security controls. They have implemented a policy that states all employees must undergo mandatory security awareness training annually. This type of control, focused on human behavior and organizational processes, falls under which category?
- APhysical Control
- BOperational Control
- CTechnical Control
- DAdministrative Control
Show answer & explanationAnswer & explanation
Correct answer: D. Administrative Control
Administrative controls are policies, procedures, and training that guide human behavior and management practices to ensure security. Security awareness training is a prime example.
Why the other options are wrong
- A. Physical controls manage access to physical resources (e.g., locks, fences).
- B. Operational controls are often a subset of administrative or technical controls that deal with the day-to-day security activities.
- C. Technical controls involve hardware or software (e.g., firewalls, encryption).
Administrative Control
Security controls implemented through policies, procedures, guidelines, and training to manage security risks and influence behavior.
- Focus on people and processes.
- Examples include policies, training, and background checks.
- Often the foundation for technical and physical controls.
Memory trick: APT covers all your security needs.