Security Controls: Technical, Administrative, and Physical
Key Takeaways
Subdomain 1.4 names three control categories: technical, administrative, and physical.
A control is classified by what it is, not by the risk it addresses.
Policies and training are administrative controls; a firewall rule is technical; a locked door is physical.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 1.4, checked 2026-10-22.
Three Categories
Subdomain 1.4, Understand cybersecurity controls, names three categories: technical controls, administrative controls, and physical controls. The category describes the control's nature. Technical controls are implemented in systems and software. Administrative controls are rules, processes, and people practices, such as policies and training. Physical controls protect facilities and hardware.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 1.4, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Classifying a Control in a Scenario
Ask what the control is made of. A system setting is technical. A written procedure that people must follow is administrative. A barrier in a building is physical. Some controls combine categories, such as a policy that requires a badge check; name the category that is primarily doing the work in the scenario.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.4: Technical controls
- 1.4: Administrative controls
- 1.4: Physical controls
Common Traps
A common trap is choosing a control by its name rather than its category. Classify the control by what it is made of, then match it to the threat the scenario describes.
Which control is administrative?
A written policy requiring access reviews
A firewall rule that blocks a port on the perimeter device for all inbound traffic from the internet
A locked server room door that requires a badge scan at the entrance and logs each entry event
An encryption setting on a laptop that protects the stored files if the device is lost or stolen
Which controls are technical? Select all that apply.
Select all that apply
A firewall rule
Encryption enabled on a database
Security awareness training
A badge reader on a door
Sections you finish are checked off in the contents.