An IT steering committee wants the enterprise's mobile workforce to use cloud-based file storage to save non-sensitive corporate data, removing the need for remote access to that information. Before…

Since the plan is to store non-sensitive data in the cloud, employees must be able to accurately distinguish between sensitive and non-sensitive data to prevent misclassification and the inadvertent exposure of sensitive information. Periodic training ensures continuous awareness and adherence to data classification guidelines, which is fundamental to the security and compliance of any data storage strategy, especially when involving cloud services.

While encryption of sensitive data at rest is a good practice, the question specifically states the cloud storage is for non-sensitive corporate data, making classification training a more immediate and relevant policy requirement to prevent sensitive data from ending up there.

A process for blocking access to cloud-based apps if inappropriate content is discovered is an enforcement mechanism for data usage, but it doesn't address the primary need to ensure employees classify data correctly before it's stored.

A requirement to scan approved cloud-based apps for inappropriate content is a monitoring activity, which is important but secondary to ensuring users correctly classify and store data according to policy from the outset.