Which core access principle restricts who may view CUI?

• A. Least privilege
• B. Need-to-know
• C. Separation of duties
• D. Compartmentalization

Answer: (B)

Need-to-know is the idea that access to CUI is granted only to individuals whose role requires seeing that information. It isn’t enough to have general clearance or system access; you must have a legitimate business reason to view a specific item of CUI. This limits exposure by making visibility contingent on what you actually need to do your job, reducing the risk of unnecessary disclosure.

Least privilege is about restricting what you can do with data once you have access, not necessarily who can see it. Separation of duties distributes responsibilities to prevent misuse, but it’s about processes and controls, not about basic viewing rights. Compartmentalization helps by isolating data into sections, which supports restricting access but the specific rule that governs who may view is need-to-know.