712-50 Question 251
Single answerA newly appointed CISO is designing an enterprise access control plan for a global engineering firm. The firm handles highly sensitive government-funded research that must be restricted based on formal data classification and clearance levels. At the same time, business unit leaders want department managers to be able to grant access to routine collaboration folders for their teams without involving central security each time. The environment includes on-premises systems, cloud collaboration platforms, and third-party contractors. Which approach should the CISO adopt to best meet both regulatory and operational requirements?
- A
Implement mandatory access control (MAC) for the regulated research environment based on classification labels and clearance, and discretionary access control (DAC) only for low-risk collaboration spaces under governance standards and periodic review.
- B
Implement discretionary access control (DAC) across all environments so data owners can quickly grant access, and rely on user awareness training to prevent unauthorized exposure of regulated research.
- C
Implement mandatory access control (MAC) across all enterprise systems, including routine collaboration platforms, so access decisions are centralized and users cannot share information without security approval.
- D
Implement role-based access control (RBAC) as the only model enterprise-wide, since RBAC eliminates the need to distinguish between mandatory and discretionary access requirements.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a risk-based, hybrid access control strategy. In practice, an enterprise access control plan should be driven by data classification, regulatory obligations, business processes, user population, system criticality, and administrative scalability. Mandatory access control is most appropriate where access must be dictated by organizational policy using labels and clearances, especially in government, defense, and other high-assurance contexts. Discretionary access control is better suited to lower-risk environments where business owners need controlled flexibility, provided that governance measures such as least privilege, approval workflows, logging, segregation of duties, contractor controls, and periodic recertification are in place. This approach is consistent with widely accepted guidance in NIST SP 800-53 access control principles, NIST SP 800-162 on attribute considerations, and ISO/IEC 27001 and 27002 guidance on access management, classification, and periodic review. A CISO should design the plan by matching control strength to risk rather than forcing a single model across all use cases.
- A. Correct.
Correct. This option aligns the access control model to business and regulatory requirements. MAC is appropriate where access must be enforced by policy using security labels, classifications, and clearances, such as government-funded or highly regulated research. DAC can be appropriate for low-risk business collaboration when data owners or managers need flexibility, but it should be bounded by governance controls such as data classification, least privilege, provisioning standards, logging, periodic access reviews, and third-party restrictions. This reflects a practical access control plan that uses different models based on risk and legal obligations.
- B. Incorrect.
Incorrect. DAC alone is not sufficient for highly sensitive regulated research where access must be centrally enforced based on formal classification and clearance criteria rather than left to the discretion of data owners. Training is useful, but it is not a compensating control for policy-enforced segregation required in high-assurance environments. This option reflects the common misconception that speed and owner convenience can substitute for mandatory policy enforcement.
- C. Incorrect.
Incorrect. While MAC is strong for highly sensitive environments, applying it uniformly to all enterprise collaboration use cases is often operationally impractical and can unnecessarily hinder business productivity. Routine collaboration spaces typically require more flexible administration. A CISO should align controls to data sensitivity, regulatory requirements, and business need rather than imposing the highest-assurance model everywhere.
- D. Incorrect.
Incorrect. RBAC is an important mechanism for simplifying administration and enforcing least privilege, but it is not a complete replacement for deciding when mandatory versus discretionary control criteria apply. RBAC can be used within broader access control architectures, including MAC- or DAC-oriented environments, but it does not eliminate the need to account for legal classification requirements, data ownership, or the distinction between centrally enforced policy and owner-managed sharing.