An information security manager is categorizing controls by type for a control inventory. Which of the following is an ADMINISTRATIVE (managerial) control?
Select an answer to reveal the explanation.
Short Explanation
Sort controls by what they're made of: rules and processes are administrative, locks and fences are physical, and anything enforced by technology is technical. The trap is that all four sound like access control, so you have to ask how each one actually does its job.
Full Explanation
Control types describe how a control is implemented. Administrative, or managerial, controls are policies, procedures, standards and personnel practices that direct behavior; technical, or logical, controls are enforced by hardware and software; and physical controls restrict or monitor physical access to facilities and equipment. A policy that requires background checks before privileged access is granted is a personnel practice set by management, so it is administrative, even though it supports access control. Badge readers on the data center floor restrict physical entry and are physical controls, even though they include electronic components. Full-disk encryption on laptops is enforced by software on the device and is a technical control protecting data if the laptop is lost or stolen. Firewall rules that limit which hosts can reach the database are configured in network devices and are technical controls. Exam caveat: control type is separate from control function, so a single control can be administrative and preventive, or technical and detective, and questions sometimes test both dimensions together. Operational check: in the control inventory, record both type and function for each control and look for risks that depend only on administrative controls with no technical enforcement, since those rely entirely on people following rules.