Which of the following is an operation control family?

• A. AT - Awareness and Training
• B. SC - System and Communications Protection
• C. IA - Identification and Authentication
• D. AU - Audit and Accountability

Answer: (A)

The concept being tested is how control families are categorized into operational controls versus technical ones. Awareness and Training is an operational control because it focuses on people and processes—training users, building security awareness, and ensuring ongoing adherence to policies. These are actions driven by policies and procedures rather than technical safeguards implemented on systems.

This kind of control reduces risk by improving human performance and reducing errors, such as recognizing phishing attempts or following secure handling procedures. In contrast, system and communications protection is about technical safeguards that shield data and communications (like encryption and boundary protection). Identification and authentication deals with credentials and verifying who is allowed to access systems, and audit and accountability focuses on recording and monitoring events to hold users accountable. While all are important, awareness and training uniquely fall under the operational, people-centered category.