Nightly log review by SOC analysts is framed as which control category, distinct from the SIEM product itself?

Operational controls are carried out by people following defined processes—scheduled log review, awareness delivery, incident handling steps, and similar human-executed routines. Nightly log review by SOC analysts is operational because analysts perform a prescribed activity to examine events and escalate findings. That category stays distinct from the SIEM product that collects and correlates telemetry.

Calling the review technical because any work involving a SIEM must be technical collapses people-process into the platform. The SIEM appliance or service is a technical control; the human review cadence is operational. Labeling the activity physical because analysts sit in a secured operations room mistakes facility location for control category—the room's locks may be physical, but reviewing logs is not a physical barrier. Framing the review as managerial because a one-page policy title exists confuses governance documentation with execution: a policy may require nightly review (managerial), yet the analysts actually performing the review each night constitute the operational control.

Exam caveat: Security+ repeatedly tests "tool versus process." Ask whether the stem highlights technology enforcing something or people executing a procedure. Municipal SOCs should inventory both.

Operational check: keep SIEM use-cases and correlation rules under technical ownership, while documenting operational playbooks for who reviews which queues, escalation SLAs, and shift handoffs. Audit that analysts actually complete the nightly review—not merely that the SIEM is licensed—and feed findings into ticket and IR workflows.