If an organization formalizes rules for who can access what resources, this is best described as?

If an organization formalizes rules for who can access what resources, this is best described as?

• A. Onboarding
• B. Authorization Workflow
• C. Security Policies
• D. Managing Change

Answer: (C)

The main idea is policy-based access control: organizations formalize rules that specify who can access which resources and under what conditions. Security policies capture these rules, such as which roles have which permissions, the authentication requirements needed to access sensitive systems, and the principle of least privilege. These policies provide the foundation for authorization decisions implemented by access controls in systems, ensuring consistent, auditable, and compliant access. Onboarding is about bringing a new user into the environment and provisioning initial access, but it’s not the set of formal rules themselves. An authorization workflow describes the steps and approvals used to grant access, the process, not the rules it enforces. Managing change covers updating controls and policies in response to evolving requirements, but again, the core idea behind “formalized rules for who can access what resources” is the security policies themselves.

The main idea is policy-based access control: organizations formalize rules that specify who can access which resources and under what conditions. Security policies capture these rules, such as which roles have which permissions, the authentication requirements needed to access sensitive systems, and the principle of least privilege. These policies provide the foundation for authorization decisions implemented by access controls in systems, ensuring consistent, auditable, and compliant access.

Onboarding is about bringing a new user into the environment and provisioning initial access, but it’s not the set of formal rules themselves. An authorization workflow describes the steps and approvals used to grant access, the process, not the rules it enforces. Managing change covers updating controls and policies in response to evolving requirements, but again, the core idea behind “formalized rules for who can access what resources” is the security policies themselves.