What is the purpose of a 'need-to-know' check before sharing logs that contain inmate identifiers?

• A. To ensure all staff can view inmate identifiers for transparency.
• B. To prevent unnecessary exposure of PII; restrict access to authorized personnel and log access events.
• C. To delay access until after a court decision.
• D. To avoid logging access events.

Answer: (B)

The main idea here is controlling who can see sensitive information and keeping a record of who looked at it. A need-to-know check before sharing logs that include inmate identifiers is about applying the principle of least privilege: only people with a legitimate, job-related need should access PII, and their access should be tracked.

This approach helps protect privacy and reduce risk, because inmate identifiers are sensitive data. Restricting access to authorized personnel limits exposure, and logging each access creates an audit trail so supervisors can see who viewed the data and when. Together, these practices promote accountability and help detect and deter misuse.

Other options don’t fit as well. Making logs visible to all staff would unnecessarily expose PII. Delaying access until a court decision shifts responsibility but isn’t the internal control the need-to-know check is about. And avoiding logging access would remove the crucial record that supports oversight and investigations.