Which category of controls includes policies, procedures, security awareness training, contingency planning, and disaster recovery plans?

Which category of controls includes policies, procedures, security awareness training, contingency planning, and disaster recovery plans?

• A. Technical Controls
• B. Administrative controls
• C. Preventative Controls
• D. Physical Controls

Answer: (B)

The main idea here is how security controls are categorized by what they address—governance and human-focused management rather than technology or the physical environment. The items listed—policies, procedures, security awareness training, contingency planning, and disaster recovery plans—are all about guiding behavior, establishing rules, and preparing people and processes to respond to incidents. That makes them administrative controls, which are management-oriented measures used to shape how security is enforced across an organization. Technical controls, by contrast, rely on technology and software or hardware safeguards like encryption, access control software, and firewalls. Physical controls cover the tangible protections in the environment, such as locks, cameras, and security guards. While there’s overlap in risk management, the specific items described fit the administrative, governance-focused category best.

The main idea here is how security controls are categorized by what they address—governance and human-focused management rather than technology or the physical environment. The items listed—policies, procedures, security awareness training, contingency planning, and disaster recovery plans—are all about guiding behavior, establishing rules, and preparing people and processes to respond to incidents. That makes them administrative controls, which are management-oriented measures used to shape how security is enforced across an organization.

Technical controls, by contrast, rely on technology and software or hardware safeguards like encryption, access control software, and firewalls. Physical controls cover the tangible protections in the environment, such as locks, cameras, and security guards. While there’s overlap in risk management, the specific items described fit the administrative, governance-focused category best.