Which item is included as a core element of a CIA?

• A. Hire a compliance officer and appoint a compliance committee
• B. Restrict employment if ineligible persons
• C. Conduct annual performance reviews
• D. Publish monthly newsletters

Answer: (B)

This item tests the idea that access control is central to protecting sensitive information. In information security, the CIA triad—confidentiality, integrity, and availability—rests on who has access to data and systems. Restricting employment to those who are eligible ensures that only vetted, authorized people can handle PHI or other sensitive information, which directly protects confidentiality by preventing unauthorized disclosure and helps preserve integrity by reducing the chance of deliberate or accidental data tampering. It also lowers the risk of service disruption caused by unqualified personnel. The other options involve governance, performance management, or awareness activities, which are important but do not directly enforce the access controls that uphold the CIA principles.