Which of the following is NOT a required field on an AAAL?

• A. Building #
• B. Resource protected
• C. Email address
• D. Last 6 of SSN

Answer: (C)

The essential purpose of an AAAL is to document who is allowed to access a specific protected resource at a given location, so the fields that identify the target and verify identity are required. Building number pins down the exact site, and the resource protected specifies exactly what is being accessed. The last six digits of the SSN are used to confirm identity in a way that minimizes exposure of full PII. Email address, while useful for notifications, isn’t needed to determine or authorize access, so it isn’t a required field.