Administrative controls are policies, procedures, and guidelines that govern how an organization manages and enforces security practices.