alan is applying access controls to ensure that employees in his company are not able to read files that are not directly related to their job functions. what goal of information security is alan enforcing?