Security Standards are divided into three categories. Which of the following lists those three categories?

• A. Administrative safeguards; Physical safeguards; Technical safeguards
• B. Confidentiality; Integrity; Availability
• C. Security controls; Risk management; Compliance
• D. Administrative controls; Physical controls; Technical controls

Answer: (A)

The main idea is that Security Standards are organized into three safeguard types: Administrative safeguards, Physical safeguards, and Technical safeguards. Administrative safeguards cover the policies, procedures, and governance a organization uses to manage security—think risk assessments, security management processes, workforce training, incident response, and contingency planning. Physical safeguards protect the actual facilities, equipment, and media—things like controlling who can access the facility, securing workstations, and managing devices and media disposal. Technical safeguards involve the technology-based measures that protect data and control access—such as unique user IDs, authentication and access controls, audit logging, data integrity measures, encryption, and protections for data in transit.

This set matches the standard terminology used for Security Standards, making it the best fit. The other concepts reference different frameworks or use different wording (for example, the CIA triad focuses on confidentiality, integrity, and availability rather than safeguard categories), so they don’t describe the three safeguard categories themselves.