Exam IIA-CIA-Part3 topic 2 question 171 discussion

D reduces the number of people who have access to the data and only to those who require and therefore presumably, are more likely to be aware of confidentiality impacts. Logs only indicate past access and do nothing to prevent disclosure.

WHY NOT D?

Limited access to information ensures that only individuals who absolutely need to access specific information can do so. This minimizes the risk of unauthorized disclosure, as employees are restricted from accessing sensitive information that falls outside their job requirements. It’s a fundamental principle of least privilege, which is key in preventing internal and external security breaches.

D is my answer as well. Any other thoughts? The most effective control in preventing the disclosure of an organization's confidential electronic information would be limited access to information based on employee duties. By restricting access to sensitive information only to employees who require it for their job responsibilities, the risk of unauthorized disclosure is minimized. This can be achieved by implementing proper access control measures, such as role-based access control or user-level permissions. Nondisclosure agreements between the firm and its employees (option A) can help establish legal consequences for disclosing confidential information, but they alone cannot prevent unauthorized access to such information.

How NDA is preventive? It should be D. Any thoughts?