What is an operational control?
An operational control is a safeguard performed mainly by people rather than by systems. Management decides what should happen; operational controls are staff doing it, shift after shift. They are one of the four Security+ control categories, with technical, managerial and physical. The protection comes from someone's actions and judgment, which is both the strength and the weakness of the category.
Examples of operational controls
- Security guards checking badges, patrolling and turning away people who are not on the list
- Receptionists running visitor sign-in, visitor badges and escorts
- Delivering security awareness training and phishing simulations
- Analysts reviewing firewall, VPN and SIEM alerts each morning
- Help desk staff confirming identity with a callback before a password reset
- Technicians following a media disposal procedure, such as shredding failed drives
- Incident responders working through a playbook
Example: the urgent password reset
A caller says she is the CFO, she is locked out minutes before a board meeting and needs a reset right away. The help desk procedure says to end the call and phone the number listed in the HR directory. The technician does, reaches the real CFO, and learns she never called. Three categories surround that moment:
- The policy requiring identity verification before any reset is managerial.
- The technician making the callback is operational.
- A self-service portal that demands a code from the user's authenticator app would be technical.
The callback only works if the technician sticks to it under pressure, so an operational control is only as strong as the training behind it and the management support for the person who says no.
Strengths and weaknesses
People handle situations no system was configured for. A guard notices that a face doesn't match the badge photo; an analyst sees that a routine-looking admin sign-in belongs to a contractor whose project ended last month. But people vary with training, attention and fatigue, and they can be rushed, fooled or bribed. Organizations pair operational controls with technical controls that never tire and with managerial reviews that check whether procedures are actually followed.
Operational vs. managerial and physical
- Managerial vs. operational: making training mandatory is managerial; delivering it is operational.
- Physical vs. operational: a camera is physical, and the guard watching its feed is operational. The gate is physical, and the guard deciding whether to open it is operational.
When a control seems to belong to two categories, there are usually two controls in the scenario.
Operational control on the CompTIA Security+ exam
Control categories are part of SY0-801 objective 1.1. A scenario describing a person performing a security task as part of their job, such as a guard, a receptionist, an analyst reviewing logs or staff following a procedure, points to operational. Guards are the classic trap: they stand at doors and gates, so physical is tempting, but Security+ study material classes them as operational because a person delivers the protection. Training is the other trap, since the mandate is managerial and the sessions are operational. Operational controls carry types as well: a guard refusing entry is operational and preventive, and a daily log review is operational and detective.