Which guideline is most relevant to controlling access permissions and roles within the system?

Which guideline is most relevant to controlling access permissions and roles within the system?

• A. Background Check
• B. Verification of a new employee's history
• C. Access Standards
• D. Deactivation Policies

Answer: (C)

Access control relies on standards that describe who can access which resources, under what conditions, and how those permissions are granted, reviewed, and revoked. These Access Standards establish the structure for roles and permissions, define how privileges are assigned, enforce principles like least privilege and separation of duties, and specify the workflows for approving changes and conducting periodic access reviews. This makes them the most relevant guideline for controlling access permissions and roles within the system, because they provide the blueprint for how access is actually defined and maintained. Background checks and verification of a new employee’s history focus on hiring decisions and trustworthiness, not on the ongoing configuration of access rights. Deactivation policies ensure access is removed when someone leaves or changes status, which is essential for lifecycle management but does not define how permissions and roles are structured in the first place.

Access control relies on standards that describe who can access which resources, under what conditions, and how those permissions are granted, reviewed, and revoked. These Access Standards establish the structure for roles and permissions, define how privileges are assigned, enforce principles like least privilege and separation of duties, and specify the workflows for approving changes and conducting periodic access reviews. This makes them the most relevant guideline for controlling access permissions and roles within the system, because they provide the blueprint for how access is actually defined and maintained.

Background checks and verification of a new employee’s history focus on hiring decisions and trustworthiness, not on the ongoing configuration of access rights. Deactivation policies ensure access is removed when someone leaves or changes status, which is essential for lifecycle management but does not define how permissions and roles are structured in the first place.