Examples of Administrative Controls for Information Security

Quick Answer

The answer is security awareness training and access control policy, as both are classic examples of administrative controls in information security. Administrative controls are management-level safeguards that define rules, roles, and responsibilities through documented directives, such as policies, procedures, and training programs, rather than through technical mechanisms like firewalls or physical barriers like locks. Security awareness training governs user behavior by educating staff on security practices, while an access control policy establishes the framework for granting or restricting access to information assets. On the Certified Information Systems Auditor CISA exam, this topic tests your ability to distinguish administrative controls from technical or physical controls—a common trap is confusing a policy (administrative) with its technical implementation, such as an access control list. Remember the mnemonic “PAT”: Policies, Awareness, and Training are the pillars of administrative controls; if it’s a document or a class, it’s administrative.