The security controls (i.e., safeguards or countermeasures) for an information system that primarily are implemented and executed by people (as opposed to systems).
Source(s):
FIPS 200 under OPERATIONAL CONTROLS
NIST SP 800-18 Rev. 1 from NIST SP 800-18

  The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by people (as opposed to systems).
Source(s):
NIST SP 800-137 from FIPS 200
NIST SP 800-30 Rev. 1 from FIPS 200
NIST SP 800-39 from FIPS 200
NIST SP 800-82 Rev. 2 from NIST SP 800-18
NIST SP 800-179 [Superseded] from FIPS 200
NIST SP 800-37 Rev. 1 [Superseded] from FIPS 200

  the day-to-day procedures and mechanisms used to protectoperational systems and applications. Operational controls affect the system and application environment.
Source(s):
NIST SP 800-16

  The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by people (as opposed to systems). Rationale: NIST SP 800-53 no longer includes the concept of operational, management, or technical controls, as it is not always clear which category any given control belongs.
Source(s):
CNSSI 4009-2015 [Superseded] under operational controls