Which three concepts describe key aspects of alternate access controls?

• A. Demonstrate an operational need; Equal or greater level of security; Explain Detect, Delay and Response (DDR)
• B. Demonstrate an operational need; Explain use of barriers; Change lock combinations if compromised
• C. Explain use of barriers; Detect, Delay and Response; Show credentials
• D. Equal or greater level of security; Explain use of barriers; Train staff

Answer: (A)

Alternate access controls are compensating measures used when the primary access controls can’t be applied, and they must meet three requirements. The best option lists: demonstrating an operational need, ensuring the alternate control provides an equal or greater level of security, and explaining Detect, Delay and Response (DDR). Demonstrating an operational need ensures access is truly necessary for the role, preventing unnecessary exposure. Requiring an equal or greater level of security guarantees the compensating control isn’t weaker than the primary controls. Documenting a Detect, Delay and Response approach provides a clear plan for how to detect a breach, delay an intruder, and respond to an incident, which is essential for maintaining protection even when preferred controls aren’t used. Other options include barriers, changing lock combinations, showing credentials, or training, which are important but do not collectively capture all three key aspects of alternate access controls.