Which statement below is NOT correct about reviewing user accounts?

A.
User account reviews can examine conformity with the concept of least privilege.

B.
User account reviews cannot be conducted by outside auditors.

C.
User account reviews may be conducted on a system-wide basis.

D.
User account reviews may be conducted on an application-byapplication basis.

Explanation:
It is necessary to regularly review user accounts on a system. Such reviews may examine the levels of
access each individual has, conformity with the concept of least privilege, whether all accounts are
still active, whether management authorizations are up-to-date, or whether required training has
been completed, for examplE. These reviews can be conducted on at least two levels: on an
application-byapplication basis or on a systemwide basis. Both kinds of reviews can be conducted by,
among others, in-house systems personnel (a selfaudit), the organizations internal audit staff, or
external auditors. Source: National Institute of Standards and Technology, An Introduction to
Computer Security: The NIST Handbook Special Publication 800-12.