ISC2 Governance, Risk and Compliance (CGRC) Practice Question

NIST SP 800-53 groups controls into management, operational, and technical classes. Personnel Security (PS) controls are concerned with screening, training, and managing people who interact with systems. Because they rely on administrative procedures carried out by staff rather than automated mechanisms or high-level governance processes, they are classified as operational controls. Management controls focus on overarching policy and risk management activities (for example, risk assessments), while technical controls rely on technology to enforce protections (for example, encryption). Physical is not one of the three NIST control classes used in the RMF context and therefore is an incorrect choice here.