In the context of need-to-know concepts, assignment to the position grants need-to-know and verification of need to know and access is the holder's responsibility.

In the context of need-to-know concepts, assignment to the position grants need-to-know and verification of need to know and access is the holder's responsibility.

• A. Both are correct
• B. Only assignment is correct
• C. Only holder's responsibility is correct
• D. Neither is correct

Answer: (A)

Need-to-know is established by the role you hold. When you are assigned to a specific position, that assignment defines the information and systems you may access—the need-to-know for your duties is granted through that role. At the same time, you are responsible for validating that your access remains appropriate. This means confirming that you still need the information for your current duties, safeguarding credentials, and reporting changes if your role or responsibilities change. By tying provisioning to the position and placing the onus on the holder to verify need-to-know and access, the system ensures access is both granted through a formal mechanism and continuously checked by the person who holds it. For example, if a job duty changes, the individual should seek revalidation of their access to reflect the new needs, and remove or adjust access that is no longer required. This combination—role-based assignment plus holder verification—matches the statement that both parts are correct.

Need-to-know is established by the role you hold. When you are assigned to a specific position, that assignment defines the information and systems you may access—the need-to-know for your duties is granted through that role.

At the same time, you are responsible for validating that your access remains appropriate. This means confirming that you still need the information for your current duties, safeguarding credentials, and reporting changes if your role or responsibilities change. By tying provisioning to the position and placing the onus on the holder to verify need-to-know and access, the system ensures access is both granted through a formal mechanism and continuously checked by the person who holds it.

For example, if a job duty changes, the individual should seek revalidation of their access to reflect the new needs, and remove or adjust access that is no longer required. This combination—role-based assignment plus holder verification—matches the statement that both parts are correct.