Operational controls are security controls primarily implemented and executed by which group?

• A. People
• B. Systems
• C. Vendors
• D. External parties

Answer: (A)

Operational controls rely on humans performing day-to-day security actions and following established procedures. They are implemented and executed primarily by people — internal staff, operators, and end-users — through processes like training, policy enforcement, incident response, and routine procedures for access, change management, and physical security. Automated systems can support these controls, and vendors or external parties may provide services, but the ongoing execution and enforcement come from people.