A chief information officer (CIO) is concerned about PII contained in the organization’s various data warehouse
platforms. Since not all of the PII transferred to the organization is required for proper operation of the data
warehouse application, the CIO requests the in needed PII data be parsed and securely discarded. Which of
the following controls would be MOST appropriate in this scenario?

A.
Execution of PII data identification assessments

B.
Implementation of data sanitization routines

C.
Encryption of data-at-rest

D.
Introduction of education programs and awareness training

E.
Creation of policies and procedures