A misplaced flash drive holding resident case data is filed only as 'clutter' by a clerk. What risk classification fits?

A misplaced flash drive holding resident case data is information risk from loss or exposure of sensitive data—not mere clutter. Treating it only as physical risk because the drive is a plastic object ignores confidentiality and privacy duties. Calling it market risk because residents might choose another service misses the data-protection core. Labeling it personnel discomfort with no information implications is incorrect. Exam caveat: portable media with sensitive civic data = information risk (often with a physical loss pathway). Operational check: open an information-incident record, assess data sensitivity and who was affected, contain (remote wipe/encryption status), notify per policy, and add controls such as encryption mandates and reduced portable-media use. Brief records and privacy officers, not only the clerk who found the "clutter." In municipal practice, record the rationale in the risk procedure or committee minutes so future staff apply the same rule under budget pressure. Re-validate after the next seasonal peak or org-chart change to confirm the civic control still holds as designed for residents and staff. In municipal practice, record the rationale in the risk procedure or committee minutes so future staff apply the same rule under budget pressure. Re-validate after the next seasonal peak or org-chart change to confirm the civic control still holds as designed for residents and staff.