Which control is specifically described as assigning access according to job roles and maintaining minimum access to sensitive information?

### Why this is right Role-based access control assigns permissions according to a person's organizational role. The course also calls for maintaining minimum access to sensitive information and regularly auditing user privileges. ### The concept Access controls govern who can use systems or information and what actions they can take. Limiting access to what a role requires reduces unnecessary exposure. Encryption protects data by transforming it, while incident response planning guides action during a breach. ### The other options - **B. Data encryption**: Encryption protects sensitive data from unauthorized access, but it does not assign user permissions by role. - **C. Incident response planning**: This concerns steps to take after a security breach, not routine assignment of user privileges. - **D. Third-party risk management**: This assesses vendors and partners rather than setting internal employee access by role. ### Terms - **Role-based access control**: An access approach that assigns permissions based on organizational roles. - **Privilege**: Permission to access information or perform an action. ### Remember Permissions tied to job roles point to role-based access control.