The security controls for an information system that primarily are implemented by people (as opposed to systems) are known as Response:

Management controls are strategic and governance-focused, involving risk management, security planning, and oversight, rather than direct human execution of day-to-day security tasks.

Operational controls are security measures executed primarily by personnel, focusing on the daily activities, procedures, and practices that ensure the secure operation of an information system. These include security awareness, incident handling, and administrative policies that rely on human implementation.

Technical controls are hardware, software, or firmware-based security mechanisms that automate protection, rather than relying on human implementation.

Logical controls are often a subset of technical controls, using software and data-based access restrictions and encryption to protect information.