A systems administrator recently joined an organization and has been asked to perform a security assessment of controls on the

organization-s file servers, which contain client data from a number of sensitive systems. The administrator needs to compare documented access requirements to the access implemented within the file system.

Which of the following is MOST likely to be

reviewed during the assessment? (Select two.)

A. Access control list

B. Security requirements traceability matrix

C. Data owner matrix

D. Roles matrix

E. Data design document

F. Data access policies