A security control category implemented by people?

A security control category implemented by people?

• A. Operational
• B. Managerial
• C. Technical
• D. Physical

Answer: (B)

The main idea here is that some security controls are about governance, policy, and oversight rather than anything you install or run. Managerial controls cover the policies, procedures, risk management, training, and accountability that guide how security is managed across the organization. They’re implemented by people—management sets the policies, assigns roles, conducts risk assessments, runs awareness programs, and plans incident response. These controls shape how other protections are applied and enforced, but they themselves are not technical implementations or physical barriers. Technical controls are the actual technologies that enforce security (encryption, access control mechanisms, firewalls). Physical controls involve tangible barriers or safeguards (locks, guards, badge readers). Operational controls cover day-to-day procedures and processes (change management, configuration management, routine maintenance). The question emphasizes who implements the control, and managerial controls are the ones driven by policy and governance carried out by people.

The main idea here is that some security controls are about governance, policy, and oversight rather than anything you install or run. Managerial controls cover the policies, procedures, risk management, training, and accountability that guide how security is managed across the organization. They’re implemented by people—management sets the policies, assigns roles, conducts risk assessments, runs awareness programs, and plans incident response. These controls shape how other protections are applied and enforced, but they themselves are not technical implementations or physical barriers.

Technical controls are the actual technologies that enforce security (encryption, access control mechanisms, firewalls). Physical controls involve tangible barriers or safeguards (locks, guards, badge readers). Operational controls cover day-to-day procedures and processes (change management, configuration management, routine maintenance). The question emphasizes who implements the control, and managerial controls are the ones driven by policy and governance carried out by people.