Which item is NOT listed as an administrative information security control?

• A. Network access
• B. HR, BCP, third party risk
• C. Asset management
• D. Data classification

Answer: (A)

Administrative controls are policies, procedures, and governance processes that guide security practices. They cover things like how personnel security is managed (HR), how continuity is planned and tested (BCP), how third-party risk is assessed and monitored, how assets are inventoried and tracked (asset management), and how data is categorized and labeled (data classification). Network access, by contrast, is a technical control implemented in systems and networks to enforce who can reach resources through authentication, authorization, and network configurations. It’s executed via devices and software (firewalls, access control lists, VPNs, NAC), not through managerial policies. So network access is not listed as an administrative control, while the others are.