How is SCI access audited?

• A. Audits occur only upon incident
• B. Only annual reviews without logs
• C. Access logs and periodic reviews are conducted to ensure that only authorized personnel have access and that changes are tracked
• D. Audits are not required

Answer: (C)

Maintaining an auditable trail of who accesses SCI and regularly verifying permissions. Access to SCI should be logged in secure systems, capturing who accessed what, when, and under what authorization. Those logs provide a continuous record that can be reviewed to detect unauthorized attempts, verify that access is limited to appropriately cleared personnel, and support investigations if needed. In addition to logging, periodic reviews of who has access—comparing current permissions against clearance levels, need-to-know, and job roles—help ensure that changes in personnel, duties, or status are reflected in access controls. When someone is added, removed, or their access scope changes, those updates must be documented and reconciled with the access control system to maintain proper accountability.

This approach is essential because relying only on incident-based checks would miss routine changes and potential gaps, and relying solely on annual reviews without logs would not provide a timely or verifiable record of who had access or of any changes over time. Stating that audits are not required conflicts with standard SCI security practices that require ongoing, verifiable auditing of access.