Which category of access control is primarily represented by organizational policies?

• A. Procedural controls
• B. Technical controls
• C. Administrative controls
• D. Physical controls

Answer: (C)

Organizational policies establish governance for how access is managed, including who can approve access, how access is granted and reviewed, and what duties and responsibilities people have. This is administrative controls—the policy and process layer that directs behavior and sets the rules for access. It provides the framework that technical and physical controls implement and enforce, rather than being the actual enforcement mechanism itself.

Technical controls are the tools that enforce access (like authentication methods and access control lists), while physical controls are the barriers and devices that restrict entry. Procedural elements describe steps, but the policy-based governance that shapes those steps falls under administrative controls.