Which elements best describe access control for CUI in information systems?

• A. Password strength and screen lock only.
• B. Policy documentation only.
• C. Role-based access, user authentication, authorization, and ongoing auditing.
• D. Public access with exceptions.

Answer: (C)

Access control for CUI hinges on confirming who is accessing data, what they are allowed to do, and keeping a record of those actions. The best description includes four interrelated elements: validating identity through user authentication, granting permissions via authorization tied to roles (role-based access control), enforcing those permissions so users can only perform what their role requires (least privilege), and continuously auditing access to monitor, review, and detect any inappropriate activity. This combination ensures that only authorized individuals with a legitimate need to know can reach CUI, and that there is accountability through logs and ongoing oversight.

Relying solely on password strength and screen locks misses the authorization and auditing pieces, so it doesn’t fully secure access. Policy documentation is important, but without enforcement and monitoring, rules aren’t actually protecting data. Public access with exceptions directly conflicts with the controlled handling required for CUI.