Which of the following MUST system and database administrators be aware of and apply when configuring systems used for storing personal employee data?

Secondary use of data by business users is a data governance and privacy concern relevant to data owners and privacy officers, not a mandatory technical configuration requirement for system and database administrators.

Security policies and standards are the formal, mandatory governance framework that system and database administrators are required to know and apply when configuring any system, especially those handling sensitive personal data. These policies define access controls, encryption requirements, audit logging, and data handling procedures that ensure compliance with both internal governance and external regulations. Administrators are directly accountable for implementing these controls as defined by the organization's security program.

The business purpose for which data is used is a consideration for data owners and privacy stewards during data classification, not a primary technical obligation imposed on system and database administrators during system configuration.

While overall protection of corporate resources is a broad organizational goal, it is not the specific, actionable, and mandatory requirement that administrators must apply; security policies and standards translate that goal into concrete configuration directives.