During an evening walkthrough, a security officer finds printed customer records left on several desks, visible to cleaning staff and visitors. Which policy most directly addresses this behavior?
Select an answer to reveal the explanation.
Short Explanation
Picture leaving your wallet on a café table while you grab a napkin; the problem isn't the wallet, it's that you walked away from it. A clean desk policy tells people to lock away sensitive papers whenever they step away. The trap is classification, which labels the records but doesn't stop them being left out.
Full Explanation
A clean desk policy requires employees to secure sensitive documents, removable media, and devices whenever their workspace is unattended, typically by locking them away at the end of the day and logging off or locking screens. Printed customer records left on desks overnight, visible to cleaners and visitors, are exactly the exposure this policy is designed to prevent, and it gives managers a clear standard to enforce through walkthroughs. A data classification policy defines sensitivity levels and handling requirements; it is foundational and would label these records confidential, but the behavior problem here is physical exposure of already-classified material, which classification alone does not address. An access control policy governs who may access systems and data electronically; the employees were authorized to print the records, so the gap is not account permissions. A data retention policy defines how long records are kept and when they are destroyed; it does not dictate where printouts are stored during the working day. Exam caveat: if the scenario described records found in an ordinary recycling bin, the data disposal policy would be the better fit. Operational check: run periodic after-hours walkthroughs, record violations by area, and pair the findings with lockable storage and reminders through the awareness program.