Explanation
A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation best describes a risk reduction technique. Risk reduction is a strategy that aims to lower the likelihood or impact of a risk by implementing controls or mitigations. For example, if a technical control is not feasible or cost-effective, a company can reduce the risk by educating users on how to avoid or handle the threat, such as using strong passwords, avoiding phishing emails, or reporting incidents.