How should restricted information be handled in MMR programs?

• A. Share with all personnel to ensure transparency.
• B. Protect and share only with authorized personnel per policy.
• C. Publicly disclose to stakeholders.
• D. Store unsecured for quick access.

Answer: (B)

In MMR programs, handling restricted information means keeping it safe by giving access only to people who have an authorized need to know and following the program’s policy. The best approach is to protect and share only with authorized personnel per policy. ThisPractices the need-to-know principle and least privilege, reducing the risk of accidental or intentional disclosure. It also supports accountability and proper safeguarding through controlled access, correct classification, secure storage, and approved channels for dissemination.

The other options violate these safeguards: sharing with everyone breaks the need-to-know rule; public disclosure exposes sensitive details to unnecessary parties; storing data unsecured creates vulnerabilities and fails to meet policy requirements.