If you need an assessment of an access control system, which IR would you consult?

• A. IR 7316
• B. IR 7298
• C. IR 7206
• D. IR 7000

Answer: (A)

Focusing the assessment on the right guidance is essential: you want the regulation that directly covers how to evaluate an access control system, including the procedures, criteria, and reporting you should use. IR 7316 provides that exact scope. It outlines what to check in an access control system—things like who has access, how access is granted and revoked, the effectiveness of authentication and authorization, and how those controls are monitored and documented. By following this IR, you ensure the assessment uses approved, consistent methods and produces findings that align with policy and audit expectations.

The other IRs address different topics. They don’t provide the specific evaluation framework for access control. For example, one focuses on data handling or classification, another on system development or lifecycle processes, and another on general information resources management. Those won’t guide the particular steps and criteria you need when assessing an access control system.