Which approach best verifies a contractor's access request?

• A. Check government-provided credentials
• B. Check government-provided credentials, contact the contractor's employer to confirm authorization, and verify the scope of access
• C. Verify only the contractor's name
• D. Accept verbal assurances

Answer: (B)

Verifying a contractor's access request hinges on confirming identity, current authorization, and the exact level of access needed. The best approach combines three checks: first, validate government-issued credentials to establish who the contractor is. Next, contact the contractor's employer to confirm they are authorized for the work and to approve the access request, ensuring the authorization is up to date. Finally, verify the scope of access to ensure it aligns with the task and follows the principle of least privilege. This creates an auditable trail and reduces the risk of granting inappropriate or outdated permissions. Relying only on credentials misses current status, accepting verbal assurances is unreliable, and verifying only a name does not prove identity or authorization.