MINIMIZE applies to

• A. MINIMIZE applies to users, not to information systems and telecommunications networks
• B. MINIMIZE applies to information systems and networks only
• C. MINIMIZE applies to message content only
• D. MINIMIZE applies to all equipment and networks

Answer: (A)

MINIMIZE is about limiting who has access to sensitive information, not just limiting the technology itself. In security practice, reducing the number of users who can see or handle the data—through need-to-know, least-privilege, and strict access controls—drastically lowers the chance of disclosure or misuse. Even a strong network or system can still be risky if many people know the sensitive information; by keeping access tightly restricted to only those who truly need it, you shrink the potential exposure.

So, the idea is to focus on the people who handle the information, rather than assuming the controls on devices or networks alone will solve the risk. For example, only authorized personnel should have access to a sensitive dataset, rather than broadly distributing it across many users or devices. The other options miss this emphasis: minimizing access to information is not about devices or networks alone, nor about limiting only the content of messages; and applying minimization to all equipment and networks would misplace the focus on the technology rather than the users who carry the information.