Which of the following is NOT an administrative control?

Locks, CCTV, and alarm systems are classified as physical security controls because they are tangible measures designed to deter or prevent unauthorized physical access to facilities, equipment, and data. Administrative controls, in contrast, are policies, procedures, and training programs that govern human behavior and business practices.

A Security Awareness Program is an administrative control as it involves policies and training to educate users.

An Information Security Policy is an administrative control as it defines rules and guidelines for information protection.

Disabling a user account upon termination is an administrative procedure or policy implementation, not a physical control.