712-50 Question 252
Single answerA global pharmaceutical company is preparing for a regulatory inspection after discovering that researchers in one therapeutic area were able to access clinical trial data from an unrelated program. The CISO has been asked to implement an enterprise access control plan that better enforces need-to-know without disrupting collaboration across research, legal, and regulatory teams. The environment includes scientists, contractors, and external partners, and access is currently granted primarily through broad departmental shared groups. Which action should the CISO prioritize FIRST to align the access control plan with need-to-know while maintaining operational efficiency?
- A
Implement role-based access control with data classification and business-owner-approved access profiles tied to job responsibilities and project assignment
- B
Require multi-factor authentication for all users accessing clinical systems, because stronger authentication enforces need-to-know
- C
Grant access based on employee department only, but require annual manager recertification for all shared folders and applications
- D
Move all clinical trial data into a single centralized repository so security administrators can manage permissions from one location
- E
Allow researchers to request temporary access to any study data through a self-service workflow without business-owner approval to reduce delays
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because the primary access control principle at issue is need-to-know, which is closely tied to least privilege and separation of duties. In the scenario, access is being granted through broad departmental groups, a common source of privilege creep and unnecessary exposure. A CISO should first establish an access model based on data classification, defined roles, project assignment, and accountable data owners. This creates a policy-driven framework for authorization decisions that can scale across internal users, contractors, and external partners while still supporting collaboration.
Need-to-know means users should only have access to information required for their current responsibilities. In practice, leading approaches include RBAC or attribute-based refinement where appropriate, combined with formal data ownership, approval workflows, periodic recertification, and joiner-mover-leaver processes. Standards and guidance such as NIST SP 800-53 access control families, NIST SP 800-162 on attribute-based access control, and ISO/IEC 27001 Annex A access control practices emphasize that authorization should be based on business and security requirements, not just convenience. MFA is important, but it addresses authentication rather than authorization. Similarly, centralized repositories and annual reviews may support governance, but they do not by themselves correct excessive access if the underlying entitlement model remains too broad.
- A. Correct.
Correct. Need-to-know is fundamentally about limiting access to only the information required to perform assigned duties. Implementing role-based access control (RBAC), supported by data classification and business-owner-approved access profiles, is the most effective first step because it translates business purpose, project assignment, and sensitivity of data into enforceable authorization rules. In this scenario, broad departmental groups are the root cause of excessive access, so the priority is to redesign authorization around least privilege and legitimate business need rather than organizational convenience.
- B. Incorrect.
Incorrect. Multi-factor authentication strengthens identity assurance, meaning it helps confirm that a user is who they claim to be. However, authentication is not the same as authorization. A user can be strongly authenticated and still have excessive access. This option addresses account compromise risk, but it does not solve the underlying need-to-know failure caused by overly broad permissions.
- C. Incorrect.
Incorrect. Department-based access is the current weakness described in the scenario. Adding annual recertification improves governance somewhat, but it still relies on broad grouping that is misaligned with actual business need and project-level sensitivity. Need-to-know usually requires more granular controls than department membership, especially in regulated and compartmentalized research environments.
- D. Incorrect.
Incorrect. Centralization may simplify administration, but it does not inherently enforce need-to-know. Poorly designed permissions in a centralized repository can still result in overexposure. The issue is not where the data resides, but how access decisions are structured, approved, and reviewed according to sensitivity and job function.
- E. Incorrect.
Incorrect. Self-service access can improve efficiency, but removing business-owner approval undermines need-to-know governance. In sensitive environments such as clinical research, access should be approved by those accountable for the data and validated against business justification. Temporary access can be appropriate, but not without proper authorization and control.