The regular review of a firewall ruleset is considered a

The regular review of a firewall ruleset is a procedural control. This type of control consists of documented processes, procedures, and guidelines that personnel are required to follow. The review is an operational task performed by individuals to ensure the firewall's technical configuration aligns with security policy. It is not automated and relies on human action and diligence, which is the hallmark of a procedural control.

B. Organization control is not a standard classification. Controls are typically categorized as technical, administrative (which includes procedural), and physical.
C. A technical control is the firewall itself, which automatically enforces access rules. The human activity of reviewing the rules is procedural.
D. A management control is broader, focusing on risk management and policy creation, such as the directive that firewall rules must be reviewed.

1. National Institute of Standards and Technology. (2020). NIST Special Publication 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. Section 2.2, "Control Structure," describes operational controls, which are primarily implemented by people (as opposed to systems) and encompass procedural controls.

2. Purdue University. (n.d.). Information Security and Privacy: Security Controls. Courseware defines procedural controls as documented instructions that users must follow. Retrieved from https://www.purdue.edu/securepurdue/identity-access/security-controls.php