What best describes the difference between SCI and SAP regarding access controls?

• A. SCI is the same as SAP.
• B. SAPs are less restricted than SCI.
• C. SCI is compartmentalized information; SAPs are highly restricted programs with additional safeguards beyond SCI.
• D. SAPs do not require any safeguards.

Answer: (C)

The key idea is understanding how access controls differ in scope and protection level. SCI (Sensitive Compartmented Information) is information that’s compartmentalized into restricted sections; access is limited by clearance and a need-to-know within those compartments. SAPs (Special Access Programs) sit on top of that: they are highly restricted programs with their own, additional safeguards beyond what SCI requires, including separate access approvals, handling rules, storage controls, and heightened oversight. In other words, SCI manages compartmentalized information, while SAPs impose extra layers of protection beyond SCI. The other options misstate the relationship, implying equal protection, less restriction, or no safeguards.