How should periodic access reviews and attestations be conducted to maintain least privilege?

• A. Involve IT staff only to review access rights.
• B. Involve business owners, validate role alignment, remove excess privileges, document attestations, and monitor exception handling and remediation.
• C. Conduct reviews only annually with no attestations.
• D. Automatically remove all privileged access monthly.

Answer: (B)