Which of the following is the BEST way to manage different IT staff access permissions for personal data within an organization?

Role-based access control (RBAC) is the best and most widely adopted method for managing permissions for groups of users, such as IT staff. RBAC assigns access rights to defined roles (e.g., 'Database Administrator', 'System Analyst') rather than to individual employees. Staff members are then assigned to the appropriate roles. This approach enforces the principle of least privilege, simplifies access management and reviews, reduces administrative overhead, and improves security by ensuring permissions are consistent and tied to job functions.

A. Mandatory access control (MAC) is too rigid for most corporate environments, as it is centrally controlled by the system based on security labels, not business roles.
B. Network segmentation is a network-level control that isolates systems; it does not manage individual user permissions to data within those systems.
C. A "dedicated access system" is a vague term for a tool. RBAC is the underlying management model or framework, which is the superior answer.

1. ISACA, CDPSE Review Manual, 2020, Domain 3: Data Protection, Section 3.3 Identity and Access Management. This section explicitly identifies RBAC as a key mechanism for enforcing access policies based on roles and responsibilities.

2. National Institute of Standards and Technology (NIST), Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, 2020, Control Family: Access Control (AC), Control: AC-2(3). This standard details RBAC as a primary method for implementing access control policies.