Controls in the OPERATIONAL class are so named because they are:

Answer

implemented primarily by people rather than by systems

Options - A. implemented primarily by people rather than by systems - B. the controls that operate at runtime rather than at design time - C. the controls owned by the IT operations team - D. the controls concerned with day-to-day availability Why - A. Correct — screening, media handling, awareness training and incident handling are all operational because a human carries them out. - B. The name genuinely misleads, and this is the misreading it produces. Runtime versus design time is not the axis. - C. Ownership by a particular team is not the criterion; a control run by HR is operational too. - D. That is closer to a category (detection and recovery) than a class, and availability is not what defines the class. Classes say who implements it — management, operational, technical. Categories say what function it performs — supportive, preventive, detection and recovery.

Stallings & Brown 5e ch15 §15.2–15.5; NIST SP 800-53 control families; ISO/IEC 27002