Who are allowed to access highly confidential files?

The correct answer is A. Employees with a business need-to-know. According to ISO/IEC 27001:2022, clause 8.2.1, the organization shall ensure that access to information and information processing facilities is limited to authorized users based on the access control policy and in accordance with the business requirements of access control2. The

Access Control and Acceptable Use

Question

Options

AEmployees with a business need-to-know
BContractors with a business need-to-know
CEmployees with signed NDA have a business need-to-know
DNon-employees designated with approved access and have signed NDA

How the community answered

(48 responses)

A
83% (40)
B
4% (2)
C
2% (1)
D
10% (5)

Explanation

According to ISO/IEC 27001:2022, clause 8.2.1, the organization shall ensure that access to information and information processing facilities is limited to authorized users based on the access control policy and in accordance with the business requirements of access control2. Therefore, only employees with a business need-to-know are allowed to access highly confidential files, and not contractors, non- employees or employees with signed NDA.

Topics

#access control#need-to-know principle#confidential information#authorization

Community Discussion

No community discussion yet for this question.

Full LEAD-AUDITOR Practice