What is the role of access control in POA, and what are common methods?

• A. To enforce video surveillance only
• B. To limit asset access to authorized individuals; methods include badges/cards, PINs, biometrics, and multi-factor authentication.
• C. To ignore user identity
• D. To grant administrative rights to all staff

Answer: (B)

Access control in POA is about ensuring that only authorized individuals can reach assets, with rules about who is allowed to access what, when, and where. It supports accountability and reduces risk by preventing unauthorized entry or use and by providing a way to prove who accessed what and when.

The best answer reflects the practical ways access control is put in place: issuing badges or cards (often as proximity or smart cards), using personal identification numbers, applying biometrics (such as fingerprint or iris), and combining methods in multi-factor authentication to strengthen verification. These methods translate the policy of “need to know” into real protections for both physical spaces and information systems, while enabling audit trails to track access events.

Surveillance alone serves mainly detection and monitoring, not preventing access. Ignoring user identity would allow anyone to enter, defeating the purpose of control. Granting administrative rights to all staff bypasses the principle of least privilege and broadens risk.