Which of the following are the examples of administrative controls? Each correct answer represents a complete solution. Choose all that apply.

A security policy is a documented administrative control because it consists of rules, standards, and procedures that govern employee behavior and organizational security practices, requiring no technical mechanism to implement.

Auditing, while it can be policy-driven, is primarily considered a detective technical control because it relies on system-generated logs and automated monitoring tools rather than purely procedural or human-based mechanisms.

Security awareness training is an administrative control because it reduces risk through human education and behavioral change rather than through hardware or software enforcement.

Data backup is an operational or technical control focused on data recovery and availability, not a policy or procedure designed to govern human behavior.