HR publishes a mandatory password-change policy for all municipal accounts. Which control category best fits that written policy?
Select an answer to reveal the explanation.
Short Explanation
A written password policy is like the employee handbook rule — leadership set the expectation on paper. That is managerial (administrative) territory. The IdP that enforces complexity is technical; the nightly ticket grind is operational.
Full Explanation
Managerial controls include policies, standards, procedures at the governance level, risk assessments, and similar administrative decisions that direct security intent. A mandatory password-change policy published by HR is a managerial control. Technical controls are technologies that enforce protections; operational controls are people performing processes; physical controls protect facilities and hardware. Enforcement mechanisms may later be technical, but the policy artifact itself is managerial.