Many important issues in computer security involve human users, designers,
implementers, and managers.
A broad range of security issues relates to how these individuals interact with computers and the
access and authorities they need to do their jobs. Since operational controls address security
methods focusing on mechanisms primarily implemented and executed by people (as opposed to
systems), personnel security is considered a form of operational control.
Operational controls are put in place to improve security of a particular system (or group of
systems). They often require specialized expertise and often rely upon management activities as
well as technical controls. Implementing dual control and making sure that you have more than
one person that can perform a task would fall into this category as well.
Management controls focus on the management of the IT security system and the management of
risk for a system. They are techniques and concerns that are normally addressed by management.
Technical controls focus on security controls that the computer system executes. The controls can
provide automated protection for unauthorized access of misuse, facilitate detection of security
violations, and support security requirements for applications and data.
Reference use for this question:
NIST SP 800-53 Revision 4 http://dx.doi.org/106028/NIST.SP.800-53r4
You can get it as a word document by clicking HERE
NIST SP 800-53 Revision 4 has superseded the document below:
SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for
Information Technology Systems, November 2001 (Page A-18).

Preventative access control is deployed to stop an unauthorized activity from occurring.

Section: Communication and Network Security