A regulator requires the company to demonstrate each quarter that every user's access to its financial systems is still appropriate for their job. Which control BEST provides this evidence?
Select an answer to reveal the explanation.
Short Explanation
An access review is the quarterly roll call: you hand each manager a list and they check off who still belongs and who doesn't. Lockouts and password rules protect sign-ins, but they don't prove anybody should have access in the first place. That's the trap.
Full Explanation
An access review, also called recertification, asks accountable reviewers, typically managers or data owners, to examine each user's current entitlements and either confirm they remain necessary or revoke them. Conducted on a defined schedule with recorded decisions, it produces exactly the evidence regulators request: who had access, who reviewed it, and what changed. It also catches privilege creep and accounts that deprovisioning missed. Account lockout after failed attempts defends against password guessing; it says nothing about whether a successfully authenticated user should hold a given permission. Password expiration changes credentials periodically, but a user with excessive access keeps that access after every password change, so it provides no evidence of appropriateness. Single sign-on improves usability and centralizes authentication, but it neither evaluates nor limits which entitlements each user holds. Exam caveat: reviews are only effective when reviewers have meaningful information, such as role descriptions and last-use data, rather than rubber-stamping long lists. Operational check: confirm the last quarterly campaign reached completion, that every revocation decision was actually enforced in the systems, and that the records are retained for auditors.