What are key components of an access control policy?

• A. Only password policy
• B. Identity verification, authorization levels, credential management, logging, and incident handling.
• C. Employee onboarding schedule
• D. Equipment inventory list

Answer: (B)

Access control policy governs who may access which resources, under what conditions, and how access is monitored. The essential pieces are identity verification to confirm who is requesting access; authorization levels to define what actions or resources each verified identity is allowed; credential management to issue, revoke, and protect the credentials used for access; logging to record access events for monitoring and forensics; and incident handling to respond to and recover from access-related security events. This combination covers the full scope of controlling and auditing access. A password policy focuses only on authentication, not on what can be accessed or how actions are tracked. An onboarding schedule or an equipment inventory list are separate processes and do not define the access control policy itself.