Sensitive design documents keep leaving the company by email because staff do not realize the files are sensitive, and the data loss prevention system cannot distinguish them from routine files. Which first step best addresses both problems?
Select an answer to reveal the explanation.
Short Explanation
Nobody can protect what they can't recognize. Put a clear label on the file, both visible to people and embedded as metadata, and suddenly your staff know to be careful and your DLP has something to key on. Encryption and new servers sound tough, but they don't tell anyone what's sensitive.
Full Explanation
Marking and labeling attach a classification to data both visibly, through headers, footers and watermarks that people can see, and invisibly, through metadata tags that security tools can read. That single step solves both stated failures: employees recognize sensitive design documents before sending them, and data loss prevention rules can match on the label to block or warn when labeled files are attached to outbound email. Full-disk encryption protects storage media if a server or drive is stolen, but documents are decrypted transparently for authorized users and attached to email in plaintext, so it neither informs staff nor helps DLP. Shortening retention reduces how long documents exist, yet active design files would still be emailed out unrecognized while they are in use. Moving documents to a restricted VLAN limits who can reach the server, but the people already sending the files have legitimate access, and the files still carry no indicator of sensitivity once they leave that server. Exam caveat: labeling enables other controls; it does not stop exfiltration on its own, so it is paired with DLP policy and training. Operational check: label a sample of design documents, confirm the label appears visibly and in file metadata, then send a labeled file to an external test address and verify the DLP rule triggers.