A security administrator configures firewall rules to block inbound traffic on port 23 (Telnet) and enforce SSH connections on port 22 instead. The administrator then creates a policy document requiring all remote access to use encrypted protocols. Which combination of control category and type best describes these actions?