A new Chief Information Officer (CIO) has been reviewing the badging and decides to write a policy that all employees must have their badges rekeyed at least annually. Which of the following…

Physical controls are tangible security measures that protect physical assets, such as fences, locks, guards, or biometric scanners, not the policies governing their use.

Corrective controls are implemented after an incident to mitigate damage or restore systems, whereas this policy is a preventative measure designed to reduce the likelihood of an unauthorized access event.

Technical controls are hardware or software mechanisms that enforce security, like firewalls, encryption, or access control systems, not the written policies that define their configuration or usage.

Administrative controls are management-oriented and include policies, procedures, guidelines, and personnel security practices. A policy written by the CIO mandating annual badge rekeying is a directive establishing a security procedure, making it a prime example of an administrative control designed to manage risk through organizational rules and oversight.