712-50 Question 250
Single answerA newly appointed CISO is designing an enterprise access control plan for a global defense contractor. The company handles highly sensitive government project data that must be protected based on formal classification levels, while also allowing business unit managers to control access to routine internal collaboration spaces. During a review, the CISO finds that project owners have been granting access to classified engineering repositories at their own discretion, creating inconsistent enforcement across regions. Which action should the CISO take FIRST to design an access control plan that aligns with both regulatory obligations and business needs?
- A
Implement mandatory access control for classified repositories based on centrally defined labels and clearance rules, and use discretionary controls only for low-sensitivity collaborative resources
- B
Allow all data owners to continue assigning access because discretionary access control provides the greatest operational flexibility across all environments
- C
Replace all existing controls with role-based access control only, since RBAC eliminates the need to classify information and define data ownership
- D
Grant access to classified repositories based primarily on managerial approval, then add logging to detect misuse after deployment
Show answer and explanation
Correct answer: A
Explanation
The best first action is to establish an access control plan that maps control models to business and regulatory requirements. For formally classified or regulated information, the key criteria for MAC include centrally enforced policy, security labels/classification, user clearances, and need-to-know restrictions. MAC is designed for environments where owners must not be free to override access decisions. By contrast, DAC is appropriate where data owners can reasonably determine access for less sensitive resources and where operational flexibility is more important than strict centralized enforcement.
A sound enterprise access control plan should begin with data classification, legal/regulatory obligations, business impact, ownership, and user access requirements. From there, the organization can choose the right mix of control approaches, including MAC for highly sensitive assets, DAC for owner-managed resources, and RBAC as an implementation mechanism to streamline provisioning and enforce least privilege. Best practices from common security frameworks such as NIST SP 800-53 (for access control policy, least privilege, separation of duties, and account management) and ISO/IEC 27001/27002 (for access control policy, information classification, and user access management) support selecting controls based on information sensitivity and business need rather than applying one model universally.
- A. Correct.
Correct. Mandatory access control (MAC) is the appropriate model where access must be enforced according to formal classification, regulatory requirements, and centrally administered policy rather than individual owner preference. In this scenario, classified engineering repositories require consistent, non-discretionary enforcement based on labels, clearances, and need-to-know. Discretionary access control (DAC) can still be appropriate for lower-risk collaboration spaces where business owners need flexibility. This option best reflects how to apply access control criteria by matching control type to data sensitivity and compliance obligations.
- B. Incorrect.
Incorrect. This reflects a common misconception that flexibility should outweigh regulatory and classification requirements. DAC allows data owners to grant access at their discretion, which may be suitable for non-classified business content, but it is not appropriate as the primary model for formally classified information. Continuing this approach would perpetuate inconsistent enforcement and increase the risk of unauthorized disclosure.
- C. Incorrect.
Incorrect. RBAC can be an important implementation mechanism within an access control plan, but it does not replace the need for data classification, ownership, or policy decisions. RBAC is often used to simplify administration by grouping permissions by job function, but for highly sensitive classified information, roles alone are insufficient unless aligned with formal classification and clearance constraints. This option confuses an administrative model with the broader policy criteria needed for access control design.
- D. Incorrect.
Incorrect. Managerial approval alone is not sufficient for access to classified repositories when formal classification rules apply. Logging is a detective control, not a substitute for preventive controls. While monitoring and audit trails are essential elements of an access control plan, they should complement, not replace, centrally enforced authorization rules for sensitive information.