What type of control is characterized as a policy or procedure?

A directive control is characterized as a policy or procedure because it establishes guidelines and mandates the behavior of individuals or organizations to achieve specific security objectives. These controls are essential for setting the framework within which other types of controls operate. By clearly outlining expectations, compliance requirements, and methods for adhering to security policies, directive controls help ensure that all personnel understand their responsibilities regarding security practices.

In the context of security management, directives often include policies on acceptable use, incident response, and overall security governance. They serve as a foundational element in developing a culture of security awareness and compliance within the organization, supporting the implementation of other controls such as preventive, technical, or physical measures, which are more focused on specific tasks and mechanisms for protecting assets.