712-50 Question 253
Single answerA newly appointed CISO is reviewing access to a pharmaceutical company's research environment after an internal audit found that several project managers could view clinical trial source data for studies outside their assigned programs. The CIO argues that broad access improves collaboration and reduces administrative overhead. The company must preserve confidentiality of highly sensitive research data while allowing staff to perform their duties efficiently. Which action should the CISO take FIRST to align the access control plan with the principle of need-to-know while minimizing business disruption?
- A
Implement role-based access control mapped to job titles across the entire research division and remove all exceptions immediately
- B
Require business data owners to classify research data and define access by role, project, and business justification, then recertify existing access against those rules
- C
Deploy a privileged access management solution for all research users and require credential checkout before accessing clinical trial data
- D
Enable detailed logging of all access to clinical trial data and use quarterly reports to identify excessive access for later remediation
Show answer and explanation
Correct answer: B
Explanation
The best answer is to first establish authoritative access criteria through data ownership, data classification, and documented business need, then validate existing entitlements against those criteria. This aligns with core access control principles including need-to-know and least privilege. In practice, effective access control plans begin with identifying the sensitivity of information assets, assigning ownership, defining who should access what and under what conditions, and then implementing technical controls that enforce those decisions. Frameworks and guidance such as NIST SP 800-53 access control family concepts, NIST SP 800-63 identity-related assurance guidance, ISO/IEC 27001 Annex A access control expectations, and ISO/IEC 27002 guidance emphasize that access should be authorized based on business and security requirements, reviewed regularly, and approved by asset or information owners. For a CCISO-level decision, the key is governance first: define the rules for access using business context, then implement and recertify access in a way that reduces risk without creating avoidable disruption.
- A. Incorrect.
This is not the best first action. Although role-based access control can support least privilege and need-to-know, mapping only to job titles is often too coarse for sensitive research environments where access also depends on specific project assignment, study involvement, and business justification. Removing all exceptions immediately could also disrupt legitimate work. A sound access control plan should be based on data classification, ownership, and defined authorization criteria before broad technical enforcement.
- B. Correct.
This is correct. Need-to-know requires that access be limited not just by organizational role, but by the specific information required to perform assigned duties. Having data owners classify the research data and define who should access it based on role, project membership, and documented business need establishes the governance foundation for appropriate access control. Recertifying existing access against those rules is the logical first step to reduce overexposure while minimizing unnecessary operational impact.
- C. Incorrect.
This is incorrect because privileged access management addresses control and monitoring of elevated or administrative accounts, not the broader business access problem described here. The issue is excessive access by standard users to sensitive research data. PAM may be valuable for administrators, but it does not establish need-to-know for business users accessing study data.
- D. Incorrect.
This is a plausible but incomplete response. Logging and reporting are detective controls and can help identify misuse or overprovisioning, but they do not by themselves enforce need-to-know. The audit already identified excessive access. The first priority is to define and enforce appropriate authorization rules through governance and access recertification, not simply to monitor the existing overbroad model.