Which of the following items is NOT used to determine the types of
access controls to be applied in an organization?

A.
Separation of duties

B.
Organizational policies

C.
Least privilege

D.
Relational categories

Explanation:
The item, relational categories, is a distracter. The other options
are important determinants of access control implementations in an
organization.