A cyber security consultant is examining security control classes for an Infrastructure as a Service (IaaS) provider. The classes measure how effectively assets are protected. What security control class would the consultant examine to gain oversight of the information system?