The assistant secretary for information and technology, in conjunction with the under secretary for benefits, perform a risk assessment of access levels to beneficiary and fiduciary records, based upon the least privilege principle, and regularly review access to ensure that principle is enforced.