Volatile security controls are assessed more frequently with objective to establish security control effectiveness or to support the calculation of a metric. Which of the following is a good example…

Common controls are inherited by multiple systems, but the commonality doesn't make their effectiveness inherently more "volatile" or require more frequent assessment across all systems than other controls.

Personnel Security (PS) controls, while important, are generally related to background checks, training, and policy adherence, which typically don't change or require assessment as frequently as technical configuration parameters.

Configuration Management (CM) is an excellent example of a volatile control family because system configurations, software patches, and hardware changes occur frequently in dynamic IT environments. Regular assessment of CM controls is crucial to ensure that baseline configurations are maintained, vulnerabilities are addressed promptly, and unauthorized changes are prevented, directly impacting system effectiveness and metrics.

Hybrid controls are a mix of common and system-specific controls, which is a classification type, not a control family, and doesn't inherently indicate volatility.