A control matrix: a. Is used to implement authentication controls b. Matches the user's authentication credentials to authorization c. Does not have to be updated d. Is designed to assist in evaluating or assessing the potential effectiveness of controls