A proposal would require hardware security tokens for every anonymous brochure PDF on the parks website. What principle should guide a more appropriate control decision?

Control selection should be proportional to asset sensitivity and stated requirements. Over-controlling low-risk public content wastes resources and can harm usability without meaningful risk reduction. Misclassifying public brochures as highly sensitive to justify extreme controls undermines a risk-based architecture.