Disaster recovery planning is typically part of which category of security controls?

• A. Physical controls
• B. Administrative controls
• C. Detective controls
• D. Technical Controls

Answer: (B)

Disaster recovery planning is a management activity that establishes policies, plans, roles, and procedures to restore operations after a disruption. This fits administrative controls because these controls govern how the organization is managed—covering governance, risk management, incident response planning, and business continuity efforts. It’s not about securing the physical environment, detecting incidents, or implementing a technology-based safeguard, which are the realms of physical, detective, and technical controls respectively.