Which of the following options correctly lists the components of the Low Tier?

Which of the following options correctly lists the components of the Low Tier?

• A. Moderate risk public trust; Noncritical-sensitive moderate risk; Secret / Confidential; 'L' access.
• B. High risk public trust; Critical-sensitive; Top Secret; SCI; 'Q' access.
• C. Low risk; Non-sensitive; Physical and logical access (HSPD-12); Credentialling.
• D. Low risk; Non-sensitive; Physical access only; No credentialling.

Answer: (C)

The concept here is that Low Tier is designed for the least-risk, non-sensitive information environment, with access controls that are simple but formal. It includes low risk and non-sensitive data, and it requires both physical and logical access to be managed through a standard government credentialing process. Specifically, using HSPD-12 means that access to facilities (physical) and to systems (logical) is tied to a government-wide standard ID, established through credentialling. This combination keeps controls appropriate to the level of risk: easy enough to grant for routine work, but still verified and tracked. The other options push toward higher risk or different access requirements. One mixes moderate risk with Secret/Confidential and specialized access levels, which belong to higher tiers. Another describes high-risk, highly sensitive material (Top Secret, SCI, etc.) and very restrictive access, far beyond Low Tier. The last option implies physical access only with no credentialling, which omits the necessary verification and the logical access component.

The concept here is that Low Tier is designed for the least-risk, non-sensitive information environment, with access controls that are simple but formal. It includes low risk and non-sensitive data, and it requires both physical and logical access to be managed through a standard government credentialing process. Specifically, using HSPD-12 means that access to facilities (physical) and to systems (logical) is tied to a government-wide standard ID, established through credentialling. This combination keeps controls appropriate to the level of risk: easy enough to grant for routine work, but still verified and tracked.

The other options push toward higher risk or different access requirements. One mixes moderate risk with Secret/Confidential and specialized access levels, which belong to higher tiers. Another describes high-risk, highly sensitive material (Top Secret, SCI, etc.) and very restrictive access, far beyond Low Tier. The last option implies physical access only with no credentialling, which omits the necessary verification and the logical access component.