Administrative Controls are policies, procedures, and guidelines that govern how an organization manages and enforces security practices to protect its data and systems.

These controls focus on shaping employee behavior and establishing frameworks for maintaining security across the organization.

These include security policies, Incident response plans (IRP), user awareness training against phishing and more.