Which data security practices are essential for grant administration?

• A. Access controls.
• B. Encryption.
• C. Backups, incident response, access controls, encryption, and protecting PII in accordance with policy.
• D. Public posting of data.

Answer: (C)

Grant administration hinges on protecting sensitive information through a layered, comprehensive set of practices. The best approach combines access controls to ensure only authorized people can view data, encryption to keep data confidential both at rest and in transit, backups to maintain data availability and enable recovery, an incident response plan to detect, respond to, and recover from security events, and explicit protections for PII in line with policy. Together, these practices address preventing unauthorized access, safeguarding data, ensuring recoverability, and complying with privacy requirements—covering confidentiality, integrity, and availability.

Relying on only one or two of these elements leaves gaps. Access controls reduce who can see data but don’t guarantee protection if data is exposed, lost, or breached. Encryption protects content but doesn’t guarantee recoverability or proper access management. Publicly posting data is virtually the opposite of secure practice and violates policy and privacy requirements.