Which of the following is a management control family?

• A. CA - Security Assessment and Authorization
• B. IA - Identification and Authentication
• C. SI - System and Information Integrity
• D. SC - System and Communications Protection

Answer: (A)

Focusing on how controls are categorized, the question tests understanding of which control family is considered a management control. Security Assessment and Authorization fits this role because it governs governance and oversight activities—how security controls are evaluated, how authorization to operate is granted, and how ongoing risk is monitored. This is about management processes and decision-making rather than implementing specific technical safeguards.

The other options point to technical or operational controls. Identification and Authentication focuses on verifying user identities and granting access, which is a technical control. System and Information Integrity deals with ensuring systems operate correctly, detecting and responding to threats, and patch management—also a technical focus. System and Communications Protection covers safeguarding data in transit and at boundaries, another technical area. Thus, they are not management controls.