New municipal laptops ship straight to end users with local administrator rights and no full-disk encryption. Which asset-security practice was skipped?
Select an answer to reveal the explanation.
Short Explanation
Handing out keys to the whole house and skipping the deadbolt is not "getting people productive faster." New laptops should leave IT already locked down, encrypted, and tied to a real user identity. Secure provisioning is the on-ramp that makes every other control possible.
Full Explanation
Shipping new municipal laptops to users with local administrator rights and no full-disk encryption skips secure provisioning with hardened baselines, encryption, and identity-bound enrollment before issue. Provisioning is the on-ramp that applies CIS controls, binds the device to a real identity, and encrypts media before city data ever lands on the disk. Skipping it trades short-term speed for wide-open endpoints that undermine every later control.
Post-incident forensic imaging before first login fails by concept: imaging is an investigative response, not a provisioning baseline for new issues. Publishing serial numbers on the city website for transparency fails as an unnecessary exposure that does not harden or encrypt devices. Placing every laptop immediately into the surplus auction queue fails because new issue devices are entering service, not exiting it—auction is disposal, not provisioning.
Exam caveat: secure provisioning/configuration management belongs at the start of the asset lifecycle, before productive use. Operational check: enroll laptops in MDM/identity, apply hardened images, enable full-disk encryption, remove standing local admin for standard users, then issue—verify compliance gates block unencrypted handoffs.