Which of the following is not a technical control family?

• A. AC - Access Control
• B. IA - Identification and Authentication
• C. CP - Contingency Planning
• D. SC - System and Communications Protection

Answer: (C)

Understanding how control families are classified helps distinguish technical safeguards from planning and governance. Technical control families implement security through systems and technology—for example, Access Control enforces who can reach resources, Identification and Authentication verifies user identities, and System and Communications Protection safeguards data and channels with technical mechanisms like encryption and secure protocols. Contingency Planning, by contrast, focuses on preparing for and recovering from incidents—planning, training, testing, and coordinating actions to maintain operations. It provides guidance and procedures rather than a direct technical safeguard applied to a system. So Contingency Planning is not a technical control family.