How should security codes be managed in a facility?

How should security codes be managed in a facility?

• A. Codes should be distributed only to those employees who need them and kept secure.
• B. Codes should be shared with all employees.
• C. Codes should be posted publicly.
• D. Codes should be entered into a shared phone note.

Answer: (A)

The main idea is to control access by giving security codes only to people who truly need them and keeping those codes secure. This follows the practice of least privilege and accountability: when only the right staff know the code, there’s less chance of it being misused, lost, or shared with those who shouldn’t have access. It also makes it easier to revoke access when someone leaves or changes roles, and to track who used the code if needed. Distributing codes to everyone or posting them publicly defeats this purpose because it broadens access far beyond what's necessary, increasing the risk of unauthorized entry. Storing a code in a shared phone note is insecure as well—devices can be lost, stolen, or accessed by others, and notes can be synced or backed up, creating exposure.

The main idea is to control access by giving security codes only to people who truly need them and keeping those codes secure. This follows the practice of least privilege and accountability: when only the right staff know the code, there’s less chance of it being misused, lost, or shared with those who shouldn’t have access. It also makes it easier to revoke access when someone leaves or changes roles, and to track who used the code if needed.

Distributing codes to everyone or posting them publicly defeats this purpose because it broadens access far beyond what's necessary, increasing the risk of unauthorized entry. Storing a code in a shared phone note is insecure as well—devices can be lost, stolen, or accessed by others, and notes can be synced or backed up, creating exposure.