Which practice helps limit access to sensitive BCC data to only personnel with a legitimate need?

• A. Public sharing
• B. Unlimited access
• C. Automatic archiving
• D. Need-to-know policies

Answer: (D)

Restricting access to sensitive data to those who actually need it is a fundamental security practice. This idea, known as need-to-know (often paired with least privilege), ensures that only personnel whose job functions require access can view or handle the information. In a Battle Control Center, that means sensitive data is visible only to those directly involved in operations, planning, or oversight, reducing the chance of accidental leaks or misuse.

Why this works: by tying access to role and purpose, you create clear boundaries around who can see what. Access can be granted based on specific duties, reviewed regularly, and revoked promptly if a person’s role changes or they no longer need the information. This also improves accountability—auditing who accessed what becomes meaningful when access is strictly limited.

To contrast briefly: public sharing would expose sensitive data to many who don’t need it; unlimited access ignores minimum-privilege principles entirely; automatic archiving deals with how long data is kept, not who can access it in the first place.