That decision should be shared by security, legal, and the relevant business owner, because the impact of file access depends on data meaning and obligation, not only technical access. Security supplies the evidence, legal interprets the notification threshold, and the business owner clarifies what the data represents.
Related resources from NHI Mgmt Group
- How do IAM teams decide whether a brokered login model is safe for production use?
- How should security teams make NHI best practices usable across the business?
- Who is accountable when password recovery fails during an incident?
- How do security teams know whether password reset controls are actually working?