Which is a concrete example of a governance, risk, and compliance (GRC) control related to access?

• A. Access governance
• B. Firewall hardening
• C. Publicly shared credentials
• D. Password expiry only

Answer: (A)

Access governance is the best fit because it embodies how governance, risk management, and compliance are applied to who can access what resources, under what conditions, and how those access decisions are reviewed and revoked. It covers defining roles, setting access policies, enforcing rights, and conducting regular access reviews to ensure least privilege and proper separation of duties, making access decisions auditable and enforceable. The other options don't capture this governance-focused oversight: firewall hardening is a technical protection practice, not a governance process for access; publicly shared credentials are a risky behavior that undermines controls; and password expiry alone is a narrow, technical control that doesn’t reflect ongoing governance and risk management of access.