Which practice best ensures ongoing accuracy of user access within CO/AO systems?

• A. Annual password changes for all users.
• B. Multi-factor authentication only for administrators.
• C. Regular access reviews.
• D. Physical security measures alone.

Answer: (C)

Regular access reviews focus on validating that each user’s permissions match their current role and removing access that is no longer appropriate. In CO/AO systems, roles and responsibilities change, employees leave, or contractors shift tasks, and permissions can drift over time. Periodic reviews—typically carried out by managers and system owners—identify and correct mismatches, revoke unnecessary privileges, and catch dormant or orphaned accounts. This directly maintains accuracy of who actually has access, supports least privilege, and strengthens audit readiness.

Other options don’t address ongoing validation of access. Annual password changes don’t adjust entitlements. Multi-factor authentication for administrators helps security but doesn’t ensure accurate access for all users. Relying on physical security alone protects devices but not the digital access rights assigned to accounts.