What does it require to define access needs for each role?

What does it require to define access needs for each role?

• A. Specify password policies for the role.
• B. Document the data retention period for access.
• C. Define access needs for each role, including system components and data resources and the privilege level.
• D. Provide access based on tenure.

Answer: (C)

Defining access needs for each role means specifying exactly what system components and data resources a given role requires, and what privilege level is necessary to perform its duties. This approach is the essence of role-based access control: you map each role to the minimum rights it needs, ensuring the principle of least privilege. By detailing, for every role, which resources are accessible and what actions are allowed (read, write, modify, delete, etc.), you can enforce consistent, policy-driven access across the organization. Password policies, while important for authentication, govern how users prove who they are, not which resources they can reach. Data retention documents concerns about how long data is kept, not who gets access to it. Granting access based on tenure assigns privileges by time with the organization rather than by job requirements, which can lead to excessive or inappropriate access.

Defining access needs for each role means specifying exactly what system components and data resources a given role requires, and what privilege level is necessary to perform its duties. This approach is the essence of role-based access control: you map each role to the minimum rights it needs, ensuring the principle of least privilege. By detailing, for every role, which resources are accessible and what actions are allowed (read, write, modify, delete, etc.), you can enforce consistent, policy-driven access across the organization.

Password policies, while important for authentication, govern how users prove who they are, not which resources they can reach. Data retention documents concerns about how long data is kept, not who gets access to it. Granting access based on tenure assigns privileges by time with the organization rather than by job requirements, which can lead to excessive or inappropriate access.