Certified Information Security Manager (CISM) Practice Exam 2026 – The All-in-One Guide to Mastering Certification Success!

An information classification policy is categorized as an administrative control because it establishes a framework for how information should be managed within an organization. This type of control focuses on the processes, procedures, and rules that govern information handling and security practices. By defining classifications for data—such as public, internal, confidential, and restricted—an administrative control helps ensure that information is handled according to its sensitivity and that appropriate safeguards are applied based on the level of classification.

Administrative controls involve the human and organizational aspects of security, which guide employees in making decisions about information and its protection. They are essential for compliance with legal and regulatory obligations and for promoting a culture of security awareness within the organization.

The other types of controls refer to different areas of focus: technical controls are implementations through technology (like firewalls or encryption), physical controls concern tangible measures to protect assets (like locks or surveillance), and logical controls relate to the access and identification mechanisms for systems and networks. Understanding the distinction between these types of controls is critical for effective information security management.