(ISC)2 Certified in Cybersecurity Practice Exam

What type of control is exemplified by the rule to secure hardcopy documents in a safe?

1. Physical

2. Technical

3. Administrative

4. Operational

The correct answer is: Administrative

The situation illustrated by securing hardcopy documents in a safe is a clear example of a physical control. Physical controls are measures taken to physically safeguard sensitive information and prevent unauthorized access to it. In this case, using a safe to store hardcopy documents protects the documents from theft, damage, or unauthorized viewing by securing them in a locked enclosure. While administrative controls refer to policies and procedures designed to govern how sensitive data should be handled, the act of securing documents specifically involves tangible, physical means of protection. The rationale behind physical controls is that while policies may dictate what should be done, physical controls are the actual implementations of those policies in a way that involves hardware or physical barriers. Technical controls, on the other hand, involve electronic or automated security measures, such as encryption or firewalls, and operational controls relate to processes and workflows involved in day-to-day operations. In this scenario, the focus is strictly on the physical act of securing documents, thus reinforcing that this is a physical control rather than an administrative, technical, or operational one.