How should a security team handle confidential information?

• A. Share with all personnel.
• B. Apply need-to-know access, secure storage, encryption, and minimize unnecessary sharing.
• C. Post on public boards.
• D. Email to external contractors without encryption.

Answer: (B)

Protecting confidential information hinges on limiting access to those who truly need it, keeping storage secure, encrypting data, and minimizing unnecessary sharing. Implementing need-to-know access through proper controls (like role-based access) ensures individuals can view information only if their role requires it. Secure storage means using protected repositories or encrypted databases and physically secure environments for documents. Encryption protects data both at rest and in transit, so even if it’s intercepted or accessed by unauthorized parties, it remains unreadable. Minimizing sharing reduces the number of points where data could leak or be exposed. These practices help meet policy and regulatory requirements and reduce risk from both insider and external threats. In contrast, widely sharing information, posting it publicly, or sending unencrypted emails to outsiders would drastically increase exposure and undermine confidentiality.