Which of the following is the BEST way to manage different IT staff access permissions for personal data within an organization?

Reference: https://www.imperva.com/learn/data-security/role-based-access-control-rbac/

Role-based access control is a method of managing different IT staff access permissions for personal

data within an organization by assigning roles to users based on their job functions and

responsibilities, and granting access rights to roles based on the principle of least privilege and need

to know. Role-based access control is the best way to manage different IT staff access permissions for

personal data within an organization, as it would help to protect the confidentiality, integrity and

availability of the personal data, and also comply with the privacy principles, laws and regulations.

Role-based access control would also simplify the administration and maintenance of access

permissions, as it would reduce the complexity and redundancy of managing individual user

accounts. The other options are not as effective as role-based access control in managing different IT

staff access permissions for personal data within an organization. Mandatory access control is a

method of managing access permissions for data or resources based on predefined security labels or

classifications, such as confidential, secret or top secret, but it does not consider the job functions or

responsibilities of the users. Network segmentation is a method of dividing a network into separate

segments or zones with different levels of access and control, based on the sensitivity and value of

the data or resources, but it does not consider the job functions or responsibilities of the

users. Dedicated access system is a method of providing access to data or resources through a

separate system or device that is isolated from other systems or networks, but it does not consider

the job functions or responsibilities of the users1, p. 91-92 Reference: 1: CDPSE Review Manual

(Digital Version)