Which policy is primarily concerned with defining access to resources and the protection rules?

Which policy is primarily concerned with defining access to resources and the protection rules?

• A. Access Control Policy
• B. Information-Protection Policy
• C. Firewall- Management Policy
• D. Special-Access Policy

Answer: (A)

Defining who can access which resources and under what rules is the core function of an access control policy. It specifies the permissions, roles, authentication requirements, and the processes for granting, revoking, and auditing access. This directly establishes how resources are protected and who is allowed to use them, enforcing least privilege and need-to-know principles. Broader information protection policies focus on safeguarding the information itself (confidentiality, integrity, availability) rather than detailing the exact access rights. A firewall-management policy deals with configuring and operating security devices that filter traffic, not with general resource access rights. A special-access policy covers elevated or exceptional access cases, but doesn’t define the standard access controls for everyday resources.

Defining who can access which resources and under what rules is the core function of an access control policy. It specifies the permissions, roles, authentication requirements, and the processes for granting, revoking, and auditing access. This directly establishes how resources are protected and who is allowed to use them, enforcing least privilege and need-to-know principles.

Broader information protection policies focus on safeguarding the information itself (confidentiality, integrity, availability) rather than detailing the exact access rights. A firewall-management policy deals with configuring and operating security devices that filter traffic, not with general resource access rights. A special-access policy covers elevated or exceptional access cases, but doesn’t define the standard access controls for everyday resources.