When a task force is charged with safeguarding proprietary information (SPI), what should be the first step that it takes?

• A. Determine what information should be protected.
• B. Shred sensitive documents.
• C. Develop an employee awareness program.
• D. Institute an encryption policy.

Answer: (C)

The key idea here is that people are the first line of defense when safeguarding proprietary information. Building awareness among employees establishes the foundation for all safeguards. When staff understand what constitutes SPI, why it must be protected, and their specific responsibilities, they’re more likely to follow procedures, recognize risky situations, and report incidents. This mindset makes later controls—like identifying and classifying sensitive data, shredding for disposal, or applying encryption policies—effective, because they’re supported by trained, compliant behavior rather than by policy alone.

If employees aren’t aware of what needs protection or how to handle it, even well-designed controls won’t be reliably applied. Shredding, encryption, and data classification depend on informed people who know when and how to use them. An awareness program creates the culture and baseline knowledge that enables all other safeguards to work as intended.