What does continuous verification imply in access control under Annex F?

• A. Verification only at initial login
• B. Verification at every access attempt
• C. Verification only after a security event
• D. Verification during maintenance windows

Answer: (B)

Continuous verification in access control means validating the user's identity and their permissions at every attempt to access a resource, not just when they first log in. In Annex F, this approach ensures that access decisions reflect current conditions—if a user's rights are revoked, their device posture changes, or the context of the access shifts, the system can enforce the updated policy immediately on the next access attempt rather than relying on a one-time check. This reduces the risk of access lingering after changes and supports dynamic, least-privilege enforcement.

Verifying only at initial login misses ongoing changes in authorization; verification only after a security event is reactive and allows a window of potential misuse; verification during maintenance windows is limited to those special periods and doesn't cover normal operation.