Which type of security control focuses on the processes and procedures that govern security?

The correct answer emphasizes the importance of administrative controls, which are crucial for establishing and maintaining security within an organization. Administrative controls are designed to create policies, procedures, guidelines, and standards that govern how security is managed.

These controls involve management's policies regarding employee behavior, training, incident response, and access controls, ensuring that all personnel understand their responsibilities and the protocols necessary for protecting organizational assets. By implementing administrative controls, organizations can effectively mitigate risks by providing clear directions on the expected conduct of employees and establishing a framework for security practices.

In contrast, technical controls involve hardware and software solutions, such as firewalls and encryption algorithms, that provide security at a technical level. Physical controls protect the physical environment, such as locked doors and surveillance cameras, while operational controls involve day-to-day procedures that help maintain security, often overlapping with administrative controls. However, it is the administrative controls that specifically focus on the overarching processes and policies that guide the security strategy of an organization.