The concept of “need-to-know” states: a. Paths to data containing sensitive information should not be published b. Documents should be marked as “confidential” and distribution kept to a minimum c....

The concept of “need-to-know” states:

a. Paths to data containing sensitive information should not be published

b. Documents should be marked as “confidential” and distribution kept to a minimum

c. Individual personnel should have access to only the information they require to perform their jobs

d. Documents should be marked as “restricted” and distribution kept to a minimum