Which of the following BEST enables the alignment of user access rights with business requirements?

A data classification policy defines the sensitivity of data, which is an input to determining access rights, but it does not *enable the alignment* of those rights with specific business requirements within systems.

A maturity model assesses the capability and effectiveness of processes, but it does not directly define or enable the alignment of user access rights with business needs.

System design best enables the alignment of user access rights with business requirements because it is during this phase that specific roles, permissions, and access controls are explicitly defined and built into the application or system architecture. By designing with business requirements in mind, access rights can be granularly tailored to job functions and data sensitivity, ensuring least privilege and segregation of duties are inherently supported.

A data architecture model describes how data is structured, stored, and integrated, which informs access decisions, but the *system design* is where the actual access controls for users are implemented based on that data architecture.