Which of the following would MOST effectively reduce the potential for inappropriate exposure of vulnerabilities documented in an organization's risk register?

Limiting access solely to senior management is too restrictive and impractical, as other personnel (e.g., risk managers, IT staff) require access to perform their duties related to vulnerability management.

Encrypting the risk register protects the data at rest or in transit, but it does not prevent authorized users from inappropriately viewing sensitive information once decrypted and accessed.

Role-based access control (RBAC) ensures that individuals are granted access to the risk register and its contents based strictly on their job function and the principle of least privilege. This method directly controls who can access what specific information within the register, thereby significantly reducing the potential for inappropriate exposure of vulnerabilities.

Requiring confidentiality agreements is a good legal and policy control, but it is a reactive measure that doesn't technically prevent inappropriate access or exposure by someone who has been granted access.