Question:Which of the following best defines managerial controls?

Comprehensive and Detailed In-Depth Explanation:

Managerial controls (also called administrative controls) include policies, procedures, and processes to ensure effective security governance. These controls include training, internal audits, security awareness programs, and management reviews. These align with ISO/IEC 27001:2022 Annex A Control A.5.2 (Information Security Roles and Responsibilities) and A.5.3 (Segregation of Duties).

B. Organizational structure controls relate to segregation of duties and job rotations, making them structural controls rather than purely managerial.

C. Technical controls involve firewalls, IDSs, and other security mechanisms, which are not managerial but technical measures.