Regarding asset security and appropriate retention, which of the following INITIAL top three areas are important to focus on?

Security control baselines establish the minimum required protections for asset classification and retention policies, ensuring consistent safeguarding across the organization. Access controls restrict who can interact with sensitive assets, directly supporting confidentiality and integrity during the asset lifecycle. Employee awareness and training ensure that personnel understand retention schedules, handling requirements, and disposal procedures, which are critical human-factor components in asset security.

While human resources and asset management have supporting roles, 'production management' is an operational function, not a primary domain focus in asset security and retention within information security frameworks like CISSP.

Supply chain lead-time and inventory control are logistics/operations concepts, and while encryption is a valid security control, these three together do not represent the foundational initial focus areas for asset security and retention policy.

Polygraphs, crime statistics, and forensics relate to investigative and law enforcement activities, not to the proactive governance of asset security and appropriate data retention practices.