(ISC)2 Certified in Cybersecurity Practice Exam

Which type of control involves processes and policies for security management?

1. Technical Controls

2. Physical Controls

3. Administrative Controls

4. Operational Controls

The correct answer is: Administrative Controls

The correct choice reflects the nature of controls that are centered around processes and policies designed for security management. Administrative controls are essential for establishing rules, procedures, and guidelines that ensure the organization’s security practices align with its objectives and compliance requirements. These controls focus on the human and organizational aspects of security, such as employee training, access control policies, incident response procedures, and risk assessment methodologies. By implementing administrative controls, organizations can define accountability, establish behavioral expectations, and enhance the overall security culture within the organization. They form the framework within which technical and physical controls operate, ensuring that resources are effectively used to mitigate risks. For instance, an organization might require regular security training for employees to raise awareness about potential threats and outline the steps to take in the event of a security breach. This training influences how personnel behave regarding security issues, demonstrating the critical nature of administrative controls in promoting a secure environment.