What is the primary purpose of inventories including access details?

• A. To ensure disaster recovery testing runs smoothly.
• B. To maximize speed of data deletion.
• C. To know where CUI exists, who has access, and ensure appropriate controls and disposal.
• D. To publish access lists publicly.

Answer: (C)

The main idea behind inventories that include access details is to know where CUI exists, who has access, and how it’s protected and disposed. This visibility is essential for enforcing least privilege, conducting timely access reviews, and ensuring data is securely handled through its entire lifecycle—from storage to disposal. Without such an inventory, you can’t reliably manage risks, respond to incidents, or demonstrate compliance. The other options miss the core purpose: disaster recovery testing is a broader continuity effort, speeding up deletion is about lifecycle timing rather than visibility, and publicly publishing access lists creates serious security risks.