Many staff now work from cafes and home offices, and several have been seen plugging in USB drives they were given at conferences. Which pair of awareness topics should the security team add to training for these staff?

Security awareness topics should follow observed risk. Remote and hybrid work introduces exposures such as untrusted public wireless networks, shoulder surfing in cafes, unattended devices, and family members using work equipment, so training covers using the corporate VPN, privacy screens, locking devices, and keeping work conversations private. Removable media and cables can carry malware or be engineered to act as keyboards or network devices when plugged in, and drives handed out at events are a known delivery method; training teaches staff not to connect unknown media and to hand found or gifted devices to IT. Together the two topics address both behaviors described. Anti-bribery rules and conflict-of-interest disclosure are compliance topics about improper payments and personal interests; nothing in the scenario involves either. Data retention schedules and legal hold procedures concern how long records are kept and when deletion is suspended; they are important governance topics but do not address public-space work or untrusted USB devices. Clean desk rules and visitor badge procedures apply to physical office environments; they do not help someone working at a cafe or deciding whether to plug in a conference giveaway. Exam caveat: training works best backed by technical controls such as blocking unapproved USB storage. Operational check: review endpoint logs for USB storage connections and track whether they decline after the training.