[s_q_b]

Very true. However, when creating security policy, one should always keep in mind those that have permission to access information, rather than those that have actual access to information.

It's a nightmare to me that there could be 15 people that have actual access to information, but a random official in the chain of command could give any one of 1.4 million people access to it without any further vetting.

[AaronFriel]

I suspect the process is a little more difficult than a random official granting access without vetting.