A chief information officer (CIO) is concerned about PII contained in the organization’s various
data warehouse platforms. Since not all of the PII transferred to the organization is required for
proper operation of the data warehouse application, the CIO requests the in needed PII data be
parsed and securely discarded. Which of the following controls would be MOST appropriate in this
scenario?

A.
Execution of PII data identification assessments

B.
Implementation of data sanitization routines

C.
Encryption of data-at-rest

D.
Introduction of education programs and awareness training

E.
Creation of policies and procedures