Which statement best reflects the principle of least privilege as it applies to SCI?

• A. Access is granted to all with the highest clearance by default.
• B. Access is determined by organizational role only, independent of compartments.
• C. Access is restricted to the minimum required to perform duties, governed by need-to-know and compartment assignments.
• D. Access is not restricted and is based on trust.

Answer: (C)

The key idea being tested is that access to SCI must be limited to what a person needs to perform their duties, and this access is controlled by need-to-know and the specific SCI compartments they are cleared for. In the SCI world, simply having a high clearance isn’t enough to grant broad access. Information is divided into compartments, and someone must have both the appropriate clearance and an explicit need-to-know for a particular compartment to access its contents. This is the essence of least privilege: you give only the minimum access required and nothing more.

So, the statement that best reflects this is the one that says access is restricted to the minimum required to perform duties, governed by need-to-know and compartment assignments. It captures both the minimum necessity and the compartment-based controls that truly define SCI access.

Why the other ideas don’t fit: granting access to all with the highest clearance by default ignores compartmentalization and need-to-know, creating excessive exposure. Relying on organizational role alone ignores the essential compartment and need-to-know controls that determine SCI access. Not restricting access and basing it on trust completely defeats the security model and increases risk of unauthorized disclosure.