ISC2 Governance, Risk and Compliance (CGRC) Practice Question

NIST FIPS 200 and SP 800-53 organize security controls into management, operational, and technical classes. Controls in the technical class are implemented and executed by information systems through hardware, software, or firmware. Multifactor authentication relies on automated mechanisms that electronically verify user identities before permitting access, placing it squarely in the technical class (specifically within the Identification and Authentication family). Management controls deal with policy and governance activities, operational controls focus on human-centered processes such as training and incident response, and compensating controls are alternative safeguards used when standard controls cannot be applied. Therefore, the requirement for multifactor authentication is a technical control.