Which of the following is NOT a type of Technical Control?

Access Control is indeed a type of technical control, as it involves mechanisms and technologies designed to restrict access to systems, networks, and data based on predefined security policies. Technical controls are typically automated and implemented through systems and software to protect the integrity, confidentiality, and availability of information.

In contrast, Media Protection involves the safeguarding of data stored on physical media, which can also involve technical measures but primarily focuses on how information is stored, handled, and disposed of. Awareness and Training, on the other hand, is primarily considered an administrative control since it involves educating users about security policies and practices to ensure they understand their roles in safeguarding information. Lastly, Physical and Environmental Protection encompasses measures to protect physical spaces and hardware from unauthorized access or environmental hazards, which are typically categorized under physical controls.

Therefore, while Access Control is foundational to technical security measures, Awareness and Training stands out as an administrative practice that aims to enhance user understanding and compliance regarding security protocols.