Carl is an IT auditor. He is evaluating system security controls, one of which locks users out of a system after too many unsuccessful access attempts. Carl consults National Institute of Standards and Technology $($NIST$)$ Special Publication $800-53($NIST $2013)$ and finds the following statement: "Determine if the system enforces the defined threshold of consecutive invalid access attempts." The statement is an example of:

a control.

an assessment method.

an assessment objects.

an assessment objective.