How should SOPs address access control and information security?

• A. Define roles, authentication methods, authorization levels, password hygiene, and incident reporting for security breaches
• B. Define only user IDs with no password rules
• C. Permit open access to all SOPs to all staff
• D. Use annual external audits only for security

Answer: (A)

The main idea is that SOPs must establish solid access control and information security measures so only the right people can use the right information in the right way. Defining roles sets up who should have access based on their responsibilities. Authentication methods specify how users prove who they are, such as passwords or multi-factor options. Authorization levels determine what each authenticated user can do, enforcing the least-privilege principle so people can access only what they need. Password hygiene covers creating strong passwords, changes over time, and avoiding password reuse, which helps prevent unauthorized access. Incident reporting provides a clear process for detecting, documenting, and responding to security breaches, so issues are handled promptly and learnings are captured.

Why this is the best fit: it covers the essential components needed to protect SOPs and related information on an ongoing basis, not just in theory. It combines who can access, how identity is verified, what each person can do, how to keep credentials secure, and how to respond when problems occur.

Why the other options don’t fit: defining only user IDs with no password rules leaves account access unprotected and prone to compromise. Open access to all SOPs defeats confidentiality and increases risk across the organization. Relying solely on annual external audits misses the day-to-day controls, monitoring, and rapid response needed to maintain security between audits.