What are Administrative Controls?
Administrative Controls are security measures implemented through policies, procedures, and governance frameworks rather than technical mechanisms. They define how security is managed within an organization.
Examples include security policies, User Awareness Training, incident response procedures, and Risk Assessment processes. These controls complement Technical Controls and Physical Controls within a Defense in Depth strategy.
What are Administrative Controls used for?
Administrative controls are used to establish governance, define responsibilities, and guide employee behavior. They are essential for ensuring compliance with regulations such as ISO/IEC 27001 and frameworks like NIST Cybersecurity Framework.
They help reduce risks such as Social Engineering and Insider Threat by promoting awareness and enforcing structured processes. They also support Governance, Risk, and Compliance (GRC) initiatives.
