Which of the following is not an example of a common security control? a) Access control b) Management control c) Operational control d) Hybrid control Solution a. Security controls not designated as common controls are considered system-specific controls and are the responsibility of the information system owner..