Certified Ethical Hacker (CEH) Practice Question

A data classification policy is a written directive created and enforced by management. Policies, standards, and procedures that influence how people act fall under administrative (sometimes called managerial) controls. Technical controls rely on technology (firewalls, encryption), physical controls protect the environment (locks, guards), and corrective controls attempt to restore systems after an incident. Because the recommendation concerns governance rather than technology or physical safeguards, it is an administrative control.