What is the purpose of access controls in RIM?

• A. To limit access to records based on role, sensitivity, and need to know.
• B. To rank records by importance.
• C. To determine how long to store records.
• D. To decide where to physically store backups.

Answer: (A)

Access controls in RIM are about who can access and interact with records, and under what circumstances. They enforce the need-to-know and least-privilege principles, ensuring that individuals can view or modify records only if their role requires it and the data’s sensitivity justifies it. By combining authentication (verifying identity) with authorization (granting specific permissions) and logging, access controls protect confidentiality and integrity and support accountability and regulatory compliance. For example, HR personnel might access payroll and personnel records, while other staff cannot, or can access only non-confidential views.

Other options describe different RIM functions: ranking or valuing records is about classification and value, not access; determining how long to store records is retention scheduling; deciding where to store backups concerns storage locations and disaster recovery. These are important, but they serve separate purposes from controlling who can see or touch records.