In industrial security, what does Need-to-know refer to?

• A. The requirement that access is limited to individuals with a need to perform duties
• B. The need to know the classification level only
• C. A generic access principle for all staff
• D. An outdated concept no longer used

Answer: (A)

Need-to-know means granting access only to information or resources that a person actually needs to perform their duties. In industrial security, this supports the principle of least privilege: even someone with high clearance should not automatically access everything, but only what their role requires. For example, a maintenance technician may need manuals for a specific machine but not access to financial records or strategic plans. This reduces the risk of information leakage or misuse by limiting exposure to only what is necessary. The idea is broader than just the classification level—access is tied to the actual duties and responsibilities, not handed out universally. The other options either misstate the concept, imply universal access, or claim the idea is obsolete, all of which don't fit current security practices.