Which of the following is a technical control family?

• A. AC - Access Control
• B. PM - Program Management
• C. PL - Planning
• D. CA - Security Assessment and Authorization

Answer: (A)

Access control is a technical safeguard built into the system to enforce who can access resources and under what conditions. It relies on concrete mechanisms like authentication (proving identity), authorization decisions (granting or denying access), and enforcement points (where access is actually enforced). These are characteristics of technical controls because they operate within the technology itself to protect the system.

The other options are administrative or governance-oriented: Program Management focuses on oversight and governance of security efforts, Planning deals with defining security objectives and roadmaps, and Security Assessment and Authorization covers evaluating, authorizing, and monitoring the system. These are not technical safeguards implemented by the system, so they aren’t the technical control family.