Are control categories actually exclusive?

Question

The four control categories are Technical, Managerial, Operational, and Physical, according to most sources about the Sec+ exam. Even this seems to be, for lack of a better term, controversial. Some seem to consider Physical to be a control type rather than a control category. It gets worse when you look at examples of different control categories.

Security awareness training is considered to be an operational control by some, because it is part of day-to-day procedures and is primarily implemented by people. However, other sources consider it to be managerial because awareness trainings are usually assigned through policy and are focused on reducing security risks. Honestly if I get a question wrong on the exam because of this it's fine, but I'm really just wondering how exclusive or even explicit these definitions are.

Another example are system backups. Some sources call system backups a technical control, which makes sense because backups are executed by computer systems. But other sources say system backups are an operational control, because they are part of ensuring that systems continue to work the way they are intended to. Can anyone help me make sense of these contradictions?

Answer 1

The control categories do not accurately categorize security measures in reality. They can be a useful tool to consider multiple solutions for a specific security issue, but categorizing security measures is neither helpful nor possible. Different organizations have their own interpretation for the control categories. NIST even removed the categories from NIST SP 800-53 because they are so ambiguous. However, for the CompTIA Security+ exam you will still get questions about categorizing security measures. Sometimes the category can be deduced from the way the question is asked. If the question asks about backup policy or how to manage the risks involved, it's mangerial. If the question is about the implementation, it's operational.

Unfortunately, this means learning how CompTIA interprets these categories and learning the intent behind their questions, instead of learning actually useful things about security.