Administrative Controls

ABDE.

Administrative controls refer to the policies, procedures, and guidelines used to manage, monitor, and regulate the behavior of people who access, use, or manage an organization's information technology assets. Administrative controls are the foundation of an effective security program and are designed to reduce the risk of unauthorized access, use, or disclosure of sensitive information. Below are the explanations of each option:

A. Conducting security-awareness training: Security-awareness training is an essential component of an organization's security program. This type of training provides employees with the knowledge and skills necessary to recognize and respond appropriately to potential security threats. It helps to reduce the risk of accidental or intentional security breaches by promoting a culture of security awareness within the organization.

B. Screening of personnel: Screening of personnel refers to the process of verifying the background and credentials of individuals who have access to sensitive information or critical systems. This process helps to ensure that employees are trustworthy and do not pose a risk to the security of the organization's assets.

C. Monitoring for intrusion: Monitoring for intrusion involves the use of monitoring tools and techniques to detect and respond to potential security threats. This includes monitoring network traffic, system logs, and user activity to identify potential threats before they can cause damage.

D. Implementing change control procedures: Change control procedures are policies and processes used to manage changes to an organization's IT systems and infrastructure. These procedures help to ensure that changes are made in a controlled and secure manner, minimizing the risk of unintended consequences or security breaches.

E. Developing policy: Policies are formal statements that define an organization's approach to security, outlining the rules, guidelines, and procedures that employees must follow to protect sensitive information and assets. Developing policy is a critical administrative control that helps to ensure that all employees understand their roles and responsibilities in protecting the organization's information assets.

In summary, all the options listed (A, B, D, E) are administrative controls. Security awareness training, screening of personnel, implementing change control procedures, and developing policy are all critical components of an effective administrative control program. Monitoring for intrusion, on the other hand, is a technical control that involves the use of technology tools and techniques to detect and respond to potential security threats.