What are the three primary Security Control Categories?

• A. Technical, Operational, Managerial
• B. Physical, Administrative, Technical
• C. Human, System, Process
• D. Preventive, Detective, Corrective

Answer: (A)

Security controls are grouped to cover governance, day‑to‑day operations, and automated protections in technology. The three main categories are managerial, operational, and technical. Managerial controls address policy, governance, risk management, and oversight—things like security policy development, risk assessments, and vendor risk management. Operational controls focus on the processes and people who run security day to day, such as incident response procedures, change control, training, and backup plans. Technical controls are the automated safeguards built into systems and networks, including access controls, encryption, firewalls, and multi-factor authentication.

This three-part framework is widely used because it ensures security is addressed at all levels—from leadership and governance (managerial) to everyday procedures (operational) to the actual technology that enforces protections (technical). While other triads exist in different contexts (for example, physical, administrative, and technical, or preventive, detective, and corrective), the combination of technical, operational, and managerial best captures the full spectrum of how security is implemented in many exam and professional settings.