SY0-401 Control Question

De_Rabbit

Would a policy of users not being allowed to send e-mails with non-company accounts be an operational control, or management control?

mmcabe

My take is:

Policy = management

What is actually done day to day OR training = operational

So the policy, on paper, would be managerial. But a training session on email compliance (working from that policy) would be operational.