A chief information officer (CIO) is concerned about PII contained in the organization’s various data
warehouse platforms. Since not all of the PII transferred to the organization is required for proper
operation of the data warehouse application, the CIO requests the in needed PII data be parsed and
securely discarded. Which of the following controls would be MOST appropriate in this scenario?

A.
Execution of PII data identification assessments

B.
Implementation of data sanitization routines

C.
Encryption of data-at-rest

D.
Introduction of education programs and awareness training

E.
Creation of policies and procedures