Which of the following is an operational control focused on people?

• A. Awareness & Training
• B. Configuration Management
• C. Contingency Planning
• D. Physical and Environmental Protection

Answer: (A)

Operational controls that focus on people are the safeguards that shape how staff behave and perform the daily tasks needed to protect information. Awareness and Training directly targets users, teaching them security policies, how to recognize phishing or social engineering, proper handling of data, and the correct incident reporting procedures. By increasing knowledge and awareness, this control reduces human error and improves adherence to security practices, which is why it’s the best fit for a question about a people-centered operational control.

Configuration Management is about maintaining secure system configurations, a technical or administrative concern rather than a people-focused activity. Contingency Planning covers preparing for and recovering from disruptions, which is about processes and continuity rather than daily user behavior. Physical and Environmental Protection deals with safeguarding facilities and equipment, focusing on physical security rather than ongoing training or awareness of personnel.