What does an access control review primarily monitor?

What does an access control review primarily monitor?

• A. Data minimization, cleansing, and standardization
• B. Encrypting data at rest
• C. Regular backups
• D. Data flow mapping

Answer: (A)

Access control reviews are about who can access data and ensuring that access is limited to what is necessary. This means focusing on reducing exposure by minimizing what data exists and is accessible, and making sure data is cleaned and standardized so access rules can be applied consistently and effectively. When data is minimized and standardized, you can enforce least privilege more reliably and prevent unnecessary access or leakage. Encryption at rest, while important for confidentiality, is a separate control that protects data even when access controls aren’t in place. Regular backups relate to availability and recovery, not who is allowed to view or use data. Data flow mapping helps understand how data moves, but the primary goal of an access control review is to limit access to only what is needed and keep data well-defined so access permissions make sense.

Access control reviews are about who can access data and ensuring that access is limited to what is necessary. This means focusing on reducing exposure by minimizing what data exists and is accessible, and making sure data is cleaned and standardized so access rules can be applied consistently and effectively. When data is minimized and standardized, you can enforce least privilege more reliably and prevent unnecessary access or leakage.

Encryption at rest, while important for confidentiality, is a separate control that protects data even when access controls aren’t in place. Regular backups relate to availability and recovery, not who is allowed to view or use data. Data flow mapping helps understand how data moves, but the primary goal of an access control review is to limit access to only what is needed and keep data well-defined so access permissions make sense.