Which control type provides guidance for acceptable activities?

Which control type provides guidance for acceptable activities?

• A. Availability
• B. BCP
• C. Asset
• D. Administrative Control

Answer: (D)

Administrative controls focus on people and processes and provide the policies, procedures, and guidelines that define what employees are allowed to do and how activities should be carried out. They establish acceptable-use policies, security training programs, change-management processes, access-control rules, incident response procedures, and role definitions. By codifying rules and expectations, these controls guide behavior and ensure consistent, compliant actions across the organization, which is precisely providing guidance for acceptable activities. In contrast, availability is a goal describing what must be kept up, not a control type; an asset is something to protect; and a business continuity plan addresses how to keep operations running during disruptions rather than day-to-day behavior guidance.

Administrative controls focus on people and processes and provide the policies, procedures, and guidelines that define what employees are allowed to do and how activities should be carried out. They establish acceptable-use policies, security training programs, change-management processes, access-control rules, incident response procedures, and role definitions. By codifying rules and expectations, these controls guide behavior and ensure consistent, compliant actions across the organization, which is precisely providing guidance for acceptable activities. In contrast, availability is a goal describing what must be kept up, not a control type; an asset is something to protect; and a business continuity plan addresses how to keep operations running during disruptions rather than day-to-day behavior guidance.