Which principle of secure design states that a security mechanism’s methods must be testable?

Which principle of secure design states that a security mechanism’s methods must be testable?

A.
Separation of privilege

B.
Least common mechanism

C.
Complete mediation

D.
Open design

E.
Economy of mechanism