What should be documented regarding access devices in a security program?

• A. Procedures for the issuance, removal, and changing of access devices.
• B. Only the locations of access devices.
• C. Colors of different badge types.
• D. Access device usage logs.

Answer: (A)

Documenting how access devices are issued, removed, and changed is essential because it defines the lifecycle controls that prevent unauthorized entry and ensure that access is granted, updated, or revoked in a controlled, auditable way. Clear procedures for issuance verify the identity of the requester, ensure proper approvals, and assign the correct access level. Removal procedures ensure timely revocation when someone leaves the company, changes role, or no longer requires access, reducing the risk of lingering permissions. Change procedures cover reassignments or adjustments to access as duties evolve, keeping permissions aligned with current responsibilities. Together, these documented steps create accountability, support audits, and enforce least-privilege access.

Other options fall short because simply noting where devices are stored doesn’t manage who actually gets access or how it’s controlled. Focusing on badge colors is cosmetic and doesn’t address access control or accountability. Access usage logs are useful for monitoring but are ineffective on their own without documented issuance, removal, and change processes to ensure that the right people have the right access at the right times.