Which statement about restricting access to payroll data reflects best practice?

• A. Restrict access to data to individuals with a need-to-know.
• B. Share data broadly to expedite service.
• C. Store data on unsecured devices to allow quick access.
• D. Print data and leave unattended in public areas.

Answer: (B)

Controlling who can view payroll data is a fundamental security practice. The best approach is to limit access to only those individuals who have a legitimate need to know to perform their job. Payroll data contains highly sensitive information such as salaries, tax identifiers, and bank details; exposing it increases the risk of identity theft, fraud, and regulatory issues. Enforcing the principle of least privilege with role-based access controls, plus regular reviews and secure authentication, reduces the risk and helps maintain privacy and compliance.

Other approaches undermine security: sharing data broadly expands who could misuse it, storing data on unsecured devices invites theft or loss, and printing sensitive information and leaving it unattended in public areas could expose it to bystanders. So restricting access to those with a genuine need to know is the most effective way to protect payroll information.