The security controls for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, and firmware components…

Operational controls are primarily implemented and executed by people, focusing on the day-to-day operations of security, such as security awareness training or incident response procedures.

Physical controls are tangible measures used to protect physical assets, such as fences, locks, guards, and surveillance cameras, rather than controls embedded within the system's components.

Technical controls are security measures that are integrated into and executed by the information system itself, utilizing mechanisms within its hardware, software, and firmware. Examples include access control lists, encryption, firewalls, and intrusion detection systems, which directly enforce security policies through technology.

Management controls are policies, procedures, and guidelines established by management to govern the overall security program, like risk assessments and security planning.