What must stay in working memory
- Classify the mechanism, not the control's desired outcome.
- Policies, risk decisions, and governance are managerial; recurring human procedures are operational.
- Logical enforcement is technical; barriers and facility protections are physical.
Concrete examples
- A risk-acceptance policy is managerial, while a technician's daily log review is operational.
- An access-control list is technical; a locked equipment cage is physical.
Decision rules you’ll retrieve
Classify a control by its mechanism
Ask what performs the control: governance (managerial), a person or procedure (operational), technology (technical), or a tangible barrier (physical).
Retrieval cue: Without looking at choices, name the four control categories and the implementation mechanism that distinguishes each one.
Separate neighboring control categories
Focus on the safeguard named in the question; classify a governing decision as managerial and a human-executed routine as operational, even when both support the same program.
Retrieval cue: Explain the boundary between managerial and operational controls, then contrast both with technical and physical enforcement.