A colleague who recently left the organization asked a security professional for a copy of the organization's confidential incident management policy. Which of the following is the BEST response to th

Emailing confidential policy documents to a former employee bypasses authorization controls and violates data classification and need-to-know principles, as the individual no longer has an active, sanctioned relationship with the organization.

Ignoring the request entirely is unprofessional and does not follow proper security incident or data request handling procedures, which typically require acknowledgment and formal processing.

Allowing a former employee to view a confidential policy on a company device - even passively - still constitutes unauthorized disclosure of sensitive information to someone who no longer has sanctioned access rights.

Submitting the request through official company channels ensures that data classification policies, need-to-know principles, and authorization controls are properly applied before any sensitive information is shared. A former employee no longer has an inherent right to access confidential policies, and official channels allow legal, HR, or management to determine if disclosure is appropriate. This follows the principle of least privilege and proper information security governance.