A company's design team is increasingly concerned about intellectual property theft. Members of the team often travel to suppliers' offices where they collaborate and share access to their sensitive…

Full disk encryption protects data if a laptop is lost or stolen but does not restrict an authorized user from copying or sharing sensitive files while physically present at a supplier's office.

A VDI environment with MFA controls how data is accessed but does not enforce geographic restrictions that prevent access from arbitrary locations including a supplier's network.

Saving files to company fileshares centralizes storage but does not by itself restrict which geographic locations or networks can reach those shares during travel.

Storing sensitive data on geographically restricted SFTP servers ensures that files can only be accessed from pre-approved locations, limiting exposure to controlled environments even when employees are at third-party sites. Authentication adds a second layer by requiring valid credentials before any data transfer occurs. Together, these controls prevent both unauthorized geographic access and unauthenticated retrieval of proprietary files.