Granting access on a need-to-know basis ensures that a service provider only has the permissions necessary to perform their specific tasks. This principle minimizes the risk of unauthorized access or accidental misuse of the system by restricting access to essential areas only. It aligns with the least privilege principle, a cornerstone of effective access control.
* Limited Administrator Access with Expiration (Option A):This is helpful but does not ensure that the access granted aligns with the specific job requirements.
* Deleting User IDs After Completion (Option C):This is a good practice but applies after the task, not during access.
* Access Corresponding to the SLA (Option D):While important, this focuses on timeframes and does not restrict permissions effectively.
Reference:ISACA CISA Review Manual, Job Practice Area 4: Protection of Information Assets.