Which control is considered key for preventing unauthorized access to sensitive data?

Access controls are a fundamental security measure designed to manage who can access specific data and resources within an organization's environment. By implementing access controls, organizations can specify permissions for users or groups, thus ensuring that only authorized individuals can access sensitive data according to their roles or responsibilities. This ensures that confidential information is safeguarded against unauthorized disclosures, which is critical for compliance with various regulations and standards.

The effectiveness of access controls lies in their ability to enforce least privilege principles, where users are granted only the permissions necessary to perform their job functions. Additionally, access controls can also include mechanisms such as multi-factor authentication, user role assignments, and session timeouts, which further strengthen the security posture regarding access to sensitive data.

While other options like encryption, logging, and firewalls are also critical components of a comprehensive security strategy, they serve different yet complementary purposes. Encryption protects data at rest and in transit, ensuring that even if data is intercepted or accessed by unauthorized parties, it remains unreadable without the proper decryption keys. Logging aids in monitoring and tracking access attempts, allowing for the detection of potential breaches, but does not prevent access itself. Firewalls regulate incoming and outgoing network traffic based on predetermined security rules but do not directly control access to specific data or resources at