Overview
Controls are also classified by type: administrative, technical, and physical. Administrative controls (also called managerial controls) are the policies, procedures, and human-focused measures that govern how people work securely. They are often underrated but shape everything else.
Learning objectives
- Define administrative controls.
- Give concrete examples.
- Explain why "people and process" controls are foundational.
Core concept
Administrative controls are implemented through management decisions, documentation, and human processes rather than technology. Examples:
- Policies and procedures — acceptable-use, password, and data-handling rules.
- Security-awareness training — teaching staff to recognize phishing and follow safe practices.
- Background checks and onboarding/offboarding — vetting new hires; promptly removing access when people leave.
- Separation of duties — splitting sensitive tasks so no single person can commit and conceal fraud.
- Risk assessments and audits — the governance activities that direct security effort.
How it works
Administrative controls set the rules and expectations that technical and physical controls then enforce. A password policy (administrative) is enforced by a password system (technical). Training reduces the chance a person falls for social engineering — addressing the "human attack surface" that no firewall can protect. Because most incidents involve human action or error, administrative controls have broad leverage.
Practical example
A company's offboarding procedure (administrative) requires that within one hour of an employee's departure, all their accounts are disabled. Without this procedure, a departed employee's still-active account is a lingering risk that technical controls alone would not catch. The procedure closes a gap that is fundamentally about process, not technology.
Cybersecurity relevance
Governance, policy, and awareness (later modules and the broader "security and risk management" domain) are all administrative controls. Auditors and frameworks like ISO 27001 place heavy emphasis on them because technology without governing process drifts and fails.
Common mistakes
- Buying technology while neglecting policy and training, leaving the human layer exposed.
- Writing policies nobody reads or enforces.
- Forgetting offboarding, so ex-staff retain access.
Key takeaways
- Administrative controls are policies, procedures, and human-focused measures set by management.
- They include training, vetting, separation of duties, onboarding/offboarding, and audits.
- They govern and give purpose to technical and physical controls, and they address the human element.
Check your understanding
- Give two administrative controls that reduce insider risk.
- Why is a password policy an administrative control while the login system enforcing it is technical?