Slickrock Technology is documenting its access control policy to ensure both efficient sharing of data and the security of its ERP system. As a medium-sized private company, it must share certain information with its investors, with governmental agencies, and with its employees.

Which of the following describes who needs access to what data in this situation?

• Employees should have access to daily reports, whereas governmental agencies and investors should receive periodic reports based on their level of contribution to the company.
• Governmental agencies should have access to necessary compliance information, relevant financial information should be provided to investors, and employees should have access to only that information needed to complete their job.
• Investors and governmental agencies should receive reports upon request, whereas employees should be provided with an individual login to access data at their convenience.
• All users should have access to the greatest amount of data possible, excepting only sensitive financial data.