When protecting the confidentiality of information assets, the MOST effective control practice is the:

Awareness training is important but it's a preventative measure that relies on human adherence and does not enforce technical controls to limit access to confidential data.

Enforcing a need-to-know access control philosophy ensures that users are granted access only to the information absolutely necessary for them to perform their job functions. This significantly minimizes the attack surface and reduces the risk of unauthorized disclosure by limiting exposure of sensitive data.

Dual-factor authentication enhances identity verification but does not, by itself, determine what specific data an authenticated user can access, which is crucial for confidentiality.

Configuring read-only access to all users is too restrictive and impractical for most business operations, as many users require write access for their duties, and it doesn't address the specific need-to-know principle.