Which of the following best describes risk-based access control in a professional environment?

• A. Grant access based on rule-of-thumb needs.
• B. Grant access based on role and need-to-know to minimize risk.
• C. Require annual access reviews regardless of role.
• D. Assign privileges randomly to test controls.

Answer: (B)

Risk-based access control centers on granting permissions only where they’re truly needed, considering how risky granting access to a given resource would be for the organization. It combines who a person is (their role) with what they actually need to know to do their job (need-to-know), and then restricts privileges to the minimum required. This approach embodies least privilege: users get just enough access to perform their duties, no more, which reduces the potential impact if credentials are compromised or a user misuses their access.

In a professional setting, tying access to role and need-to-know helps protect sensitive data and critical systems because access is earned based on job responsibilities and the sensitivity of the information involved. It also supports ongoing governance: as roles change or as certain data becomes more sensitive, access can be adjusted accordingly rather than relying on broad, static permissions.

Choosing this approach over methods like rule-of-thumb granting, which is imprecise and risky; annual reviews, which can leave gaps between reviews; or random privilege assignment, which completely undermines security, keeps access aligned with actual risk and business needs.