**Managerial controls** address the human component of cybersecurity. These controls include policies and procedures that define how an organisation manages data and clearly defines employee responsibilities, including their role in protecting the organisation. While administrative controls are typically policy based, the enforcement of those policies may require the use of technical or physical controls. Examples of administrative controls: | **Control Name** | **Control Type** | **Control Purpose** | | :-- | :--: | :--: | | Least Privilege | Preventative | Reduce risk and overall impact of <br>malicious insider or compromised accounts | | Disaster recovery plans | Corrective | Provide business continuity | | Password policies | Preventative | Reduce likelihood of account compromise<br>through brute force or dictionary attack<br>techniques | | Access control policies | Preventative | Bolster confidentiality and integrity by <br>defining which groups can access or <br>modify data | | Account management<br>policies | Preventative | Managing account lifecycle, reducing <br>attack surface, and limiting overall impact <br>from disgruntled former employees and <br>default account usage | | Separation of duties | Preventative | Reduce risk and overall impact of <br>malicious insider or compromised accounts |