Administrative Controls: Policies and Training

Quick Answer

Security awareness training qualifies as an administrative control because administrative controls are defined by what they govern, meaning people, processes, and policy, rather than by physical barriers or technical enforcement mechanisms. Training programs work by shaping human behavior and knowledge: teaching employees to recognize phishing attempts, follow proper data-handling procedures, and understand their security responsibilities, which reduces the likelihood of human error becoming the weak link in the organization's defenses. Access control policies belong in the same category for a related reason; they're the documented rules, procedures, and assigned responsibilities that establish how access should be managed, providing the governance framework that technical controls, like an actual access control system, and physical controls, like badge readers, are then built to implement. Neither training nor policy directly blocks or physically prevents anything on its own; instead, they set expectations, build capability, and define rules that other layers of control then enforce or that people are expected to follow voluntarily. This is the key distinction from technical controls, which use hardware or software to directly enforce restrictions, and physical controls, which use tangible barriers. When a question asks you to classify a control, ask whether it works through documented policy, procedure, or human education, and if so, it's administrative, regardless of what topic it happens to address.