What is a managerial control?
A managerial control is a safeguard that comes from management's decisions about security and from the documents and reviews that record them. It doesn't filter packets or lock doors. It decides which other controls the organization needs, sets the rules people and systems must follow, assigns owners and checks whether controls work. Managerial controls are also called administrative controls. They are one of the four Security+ control categories, alongside technical, operational and physical.
Examples of managerial controls
- Risk assessments and the risk register that ranks which risks to treat first
- Information security policies, standards and the acceptable use policy
- Security plans, budgets and the choice of which controls to deploy
- Personnel rules such as background checks, separation of duties, mandatory vacation and job rotation
- Vendor risk assessments and security requirements written into contracts
- Change approval by a change advisory board
- Data classification schemes
- Access reviews, internal audits and reviews of control effectiveness
How managerial controls work through the other categories
A managerial control usually takes effect through other controls. Picture a company that decides customer data may never go into personal cloud storage. The decision and the written rule are managerial. The web proxy rule that blocks those upload sites is technical. The training session where staff hear the rule explained is operational. And because the rule exists in writing, HR has grounds to act when someone breaks it.
That chain shows the category's limit: a policy by itself stops nobody. Its value is direction. Without it, administrators configure controls inconsistently, money goes to the wrong risks, and nobody is accountable when a control fails.
Managerial vs. operational controls
Many frameworks use a three-way split of administrative, technical and physical, with policies, procedures and training all counted as administrative. Security+ divides that administrative group in two. Managerial covers decisions, planning and oversight; operational covers people carrying out security tasks day to day. A quick test: if the control is a decision or a document, it is managerial; if it is a person performing a task, it is operational. Requiring all staff to finish security training each year is managerial. Running the training sessions is operational, and so is the receptionist checking visitor IDs.
Managerial controls have types too
Category and type are separate labels. An acceptable use policy is managerial and directive. Background checks are managerial and preventive. Mandatory vacation is managerial and detective, because a colleague covering the role may uncover fraud the regular employee was hiding. A sanctions policy that spells out discipline for violations is managerial and deterrent.
Managerial control on the CompTIA Security+ exam
Control categories are part of SY0-801 objective 1.1. Wording such as policy, standard, plan, risk assessment, governance, review, oversight or approval points to managerial, and so does administrative. Scenarios often pair a rule with its enforcement in one sentence, such as a company that bans USB drives and blocks them through Group Policy. The ban is managerial and the Group Policy setting is technical, so read which control the question asks about. The main distractor is operational: if a person is doing the work, such as delivering training or reviewing logs, the answer is operational.