Which principle states that access is granted only if necessary for tasks?

Which principle states that access is granted only if necessary for tasks?

• A. Error Detection
• B. Need-to-Know Principle
• C. Security Labels
• D. Redundancy

Answer: (B)

Need-to-know access is the principle that information access is limited to what is required to complete a given task. This means people receive permissions strictly for the duties they must perform, reducing unnecessary exposure and lowering the risk of unauthorized data access. It aligns with the broader idea of least privilege, but focuses on whether access is needed to carry out a specific task. The other options don’t address granting access based on task requirements: error detection is about finding faults, security labels categorize data for handling, and redundancy is about keeping systems available and resilient. For example, a payroll clerk would only access payroll data when their job requires it, and would not be granted access to unrelated confidential documents unless necessary for a specific task.

Need-to-know access is the principle that information access is limited to what is required to complete a given task. This means people receive permissions strictly for the duties they must perform, reducing unnecessary exposure and lowering the risk of unauthorized data access. It aligns with the broader idea of least privilege, but focuses on whether access is needed to carry out a specific task. The other options don’t address granting access based on task requirements: error detection is about finding faults, security labels categorize data for handling, and redundancy is about keeping systems available and resilient. For example, a payroll clerk would only access payroll data when their job requires it, and would not be granted access to unrelated confidential documents unless necessary for a specific task.