Question

An information security manager wants to evaluate whether a newly implemented set of access controls is operating effectively in the production environment, rather than merely confirming that the controls have been documented and configured. Which approach provides the MOST reliable evidence of control effectiveness?

Accepted Answer

Performing operational testing that verifies the controls consistently produce the intended results over a period of time

Answer

Reviewing the control design documentation and confirming approval by the control owner

Answer

Interviewing system administrators to confirm they understand the access control procedures

Answer

Confirming that the access control settings match the approved security baseline configuration