A chief Financial Officer (CFO) has asked the Chief Information Officer (CISO) to provide responses to a recent audit report detailing deficiencies in the organization security controls. The CFO…

Password complexity policies are an authentication control, governing how identity is verified rather than what an authenticated user is permitted to do.

Hardware tokens are an authentication mechanism used to verify identity (who you are), not an authorization control that governs resource access.

Biometric systems are an authentication control that verifies a user's identity based on physical characteristics, not a mechanism for controlling what resources a user may access.

Role-based permissions (RBAC) is a core authorization control that restricts system access based on a user's defined role within the organization, directly governing what resources and actions an authenticated user is permitted to access.

One-time passwords are an authentication control providing time-limited credentials to verify identity, not a mechanism for defining or enforcing access permissions.

Separation of duties is an authorization control that divides critical tasks among multiple individuals to prevent fraud and error, ensuring no single user has unchecked authority over sensitive processes.

Multifactor authentication is an authentication control that strengthens identity verification by requiring multiple proofs of identity, rather than governing what an authenticated user is authorized to do.

Single sign-on is an authentication convenience mechanism that allows users to authenticate once and gain access to multiple systems, but it does not define or enforce authorization permissions.