Which of the following is instituting a security policy that users must lock their systems when stepping away from their desks an example of?

Configuration management involves establishing and maintaining consistency of a product's performance, functional, and physical attributes, not user behavior policies.

A compensating control is an alternative security measure used when a primary control is not feasible or effective, which is not the case here.

While this policy might be communicated through awareness and training, the policy itself is the control, not the delivery method.

An administrative control refers to policies, procedures, and guidelines established by management to govern information security practices, often focusing on human behavior and operations. Instituting a policy for users to lock their systems is a clear example of an administrative control, as it sets a rule for user conduct rather than being a technical or physical measure.