TechKnowSurge
CompTIA Security+ 1.1 ISC2 CISSP 1.2
TechKnowSurge Catalog Interactives Technical, Managerial, Operational or Physical?
InteractiveSecurityFree

Technical, Managerial, Operational or Physical?

Run by technology, by the program's managers, by people day to day, or built into the building? Sort each control.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

A control is any measure put in place to reduce risk. Security+ (SY0-701) sorts controls into four categories by how they are carried out: Technical: carried out by technology. A firewall, encryption, endpoint protection, an intrusion detection system, multi-factor authentication. Physical: protects the physical space and equipment. Fences, gates, locks, bollards, mantraps. Operational: the day-to-day procedures people carry out. Following the help desk's reset procedure, signing visitors in, security awareness training, setting up accounts from a checklist. Managerial: running the security program and its risk. Risk assessments, deciding which risks to treat, planning the program, reviewing a vendor's risk, reporting risk to leadership. The lesson admits that managerial and operational are the confusing pair: both are about people and paper rather than technology. Ask what the control is for. If it manages the program and its risks, it is managerial. If it is a procedure people carry out in the business's daily work, it is operational. NIST no longer uses the managerial category, but Security+ still does. A category says how a control is carried out. Its type (preventive, detective and so on) says what job it does; that is the next lesson.

What you'll learn

Aligned to

CompTIA Security+
1.1 Compare and contrast various types of security controls.
ISC2 CISSP
1.2 Understand and apply security concepts

Key terms

Physical Control
A security control that protects assets through tangible, real-world measures — such as locks, security cameras, mantraps, fences, and safes — to prevent unauthorized physical access or tampering.
Technical Control
A security control implemented through technology — such as firewalls, antivirus software, encryption, or access control systems — rather than through physical measures or administrative policies.
Operational Control
A security control based on procedures and processes that guide day-to-day business functions to maintain security.
Managerial Control
A security control focused on managing the security program, including risk assessments and overarching risk management activities.
Risk Assessment
The process of identifying, analyzing, and evaluating risks to determine their potential impact.

Topics

Security Control Control Categories Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →