When new access needs arise, how are additions to an EAL typically handled?

• A. Separate EALs; updated version if original becomes cumbersome
• B. Direct edits by SF supervisor
• C. Remove old EAL and create new
• D. Attach an addendum letter

Answer: (A)

When new access needs arise, handling additions by issuing separate EALs keeps each request distinct and auditable. Each separate EAL documents the specific access granted, who approved it, and when, without altering earlier authorizations. This preserves a clear history of permissions and supports accountability and traceability, which are essential in security operations.

If the original EAL becomes unwieldy due to many additions, updating the version is the right path because it preserves the historical record while providing a consolidated, current reference. This versioning approach avoids losing prior approvals and maintains a coherent change history.

Direct edits by a supervisor risk bypassing proper change control and eroding the audit trail, since there’s no formal record of who made the modification or when. Removing the old EAL and creating a new one can wipe away the context of prior access decisions and create gaps in documentation. An addendum letter might document a change, but it doesn’t replace the formal authorization record within the EAL system or provide the same built-in version history and traceability.