You are creating a document that describes the access rights to the financial system in your organization. It defines access by roles and responsibilities and describes the approval process for obtaining access. One of the rules stated in the document dictates that remote access to systems requires MFA. Which of the following are true regarding this question? (Choose two.)

A. This question describes an operational security policy.

B. This question describes a digital security policy.

C. This question describes a process of verifying identity by requiring two or more forms of identification at sign‐in.

D. This question describes a form of data classification.

E. This question describes a data security policy.