A company security policy states that all laptops must be configured with full disk encryption before they are issued to employees. Which control type is the policy statement itself?

Directive controls specify required actions or behavior, usually through policies, standards, procedures, or posted instructions. A policy requiring full disk encryption before issuance tells IT what must be done; the protection depends on people and systems following it. The encryption that results is a separate, preventive technical control that keeps data unreadable if a laptop is lost or stolen, but the question asks about the policy statement, not the encryption itself. Calling the policy preventive conflates the directive with the safeguard it mandates; a policy document cannot stop anyone from reading a disk. Technical is a control category, describing how a control is implemented, not a control type; moreover, the policy is a document rather than a software or hardware mechanism. Corrective controls fix problems after an incident, such as restoring data or reimaging a device; a policy issued in advance does not correct an existing compromise. Exam caveat: a single security outcome often involves several controls of different types, such as a directive policy, a preventive encryption setting, and a detective compliance report, and questions test whether you can separate them. Operational check: confirm that endpoint management reports encryption status for every issued laptop, that devices failing the check cannot be issued, and that the policy names an owner and review cycle.