Which control is intended to enforce adherence to security policies across an organization?

Which control is intended to enforce adherence to security policies across an organization?

• A. Deterrent Control
• B. Detective Control
• C. Preventive Control
• D. Directive Control

Answer: (D)

Directive controls are administrative measures that set expectations and mandate compliance with security policies across the organization. They enforce adherence by requiring everyone to follow defined policies, complete security awareness training, sign policy acknowledgments, and follow documented procedures. Because their purpose is to compel compliance and shape behavior to align with policy, they are the mechanism that ensures policy is followed organization-wide. Deterrent controls rely on penalties to discourage violations, detective controls identify or reveal violations after they occur, and preventive controls aim to stop incidents before they happen. Directive controls uniquely focus on governance and required actions to ensure people and processes adhere to security policies.

Directive controls are administrative measures that set expectations and mandate compliance with security policies across the organization. They enforce adherence by requiring everyone to follow defined policies, complete security awareness training, sign policy acknowledgments, and follow documented procedures. Because their purpose is to compel compliance and shape behavior to align with policy, they are the mechanism that ensures policy is followed organization-wide.

Deterrent controls rely on penalties to discourage violations, detective controls identify or reveal violations after they occur, and preventive controls aim to stop incidents before they happen. Directive controls uniquely focus on governance and required actions to ensure people and processes adhere to security policies.