Which of the following is not an operation control family?

• A. AT - Awareness and Training
• B. AU - Audit and Accountability
• C. CP - Contingency Planning
• D. MA - Maintenance

Answer: (B)

Operational controls are the security measures you implement to protect and sustain day-to-day system operations. Awareness and Training directly affects how people behave and use the system, helping ensure secure daily use. Contingency Planning prepares the organization to continue or recover operations during disruptions. Maintenance keeps systems and software up to date and functioning securely as part of normal operations. Audit and Accountability, by contrast, is about logging, monitoring, and enforcing accountability—it's governance and oversight to ensure policies are followed and events are tracked. That makes it a management control rather than an operational one, so it’s not classified as an operation control family.