What is the function of an access control list in an SCI environment?

• A. It lists all employees in the building
• B. It lists individuals authorized to access SCI materials, and is regularly reviewed and updated to reflect need-to-know changes
• C. It records times of access
• D. It tracks safety inspections

Answer: (D)

An access control list in an SCI environment defines who is permitted to access SCI materials and specifies the level of access they have. In this context, clearance alone isn’t enough—each person must have a need-to-know for the specific information or compartment. The ACL is actively maintained and reviewed to reflect changes in roles, assignments, or need-to-know determinations, ensuring that only authorized individuals retain access. This keeps sensitive information restricted and reduces the risk of unauthorized disclosure.

Other options don’t fit the function of an ACL: listing everyone in the building isn’t tied to access to SCI materials; recording access times is handled by audit logs or access logs rather than the permission list itself; and tracking safety inspections is a separate process not about granting access to SCI materials.