Change management policies and procedures belong to which of the following types of controls?

Directive controls are administrative mechanisms - such as policies, procedures, standards, and guidelines - that instruct personnel on how to behave or perform actions. Change management policies fall squarely into this category because they define the rules and processes that govern how changes are requested, approved, and implemented, directing organizational behavior before any incident occurs.

Detective controls are designed to identify and alert on security incidents or policy violations after they have occurred (e.g., log monitoring, intrusion detection systems), not to prescribe behavior.

Corrective controls are implemented to remediate or restore systems and processes after a security incident or failure has already taken place (e.g., patch management, backups), not to direct behavior.

Preventative controls are technical or physical mechanisms that actively block or stop unwanted events from occurring (e.g., firewalls, access controls), whereas change management policies direct behavior rather than technically preventing actions.