A security officer needs to find the most cost-effective solution to the current data privacy and protection gap found in the last security assessment. Which of the following is the BEST…

Requiring users to sign NDAs (Non-Disclosure Agreements) is a legal control, not a technical or procedural solution for data privacy and protection gaps, and it doesn't prevent breaches.

A data minimization plan aims to reduce the amount of data collected, processed, and stored to only what is absolutely necessary. By having less sensitive data to protect, the overall risk surface is significantly reduced, which inherently makes other security controls more efficient and often lowers the cost of data privacy and protection efforts compared to implementing expensive technical solutions for large datasets.

While adding access control requirements is a good security practice, it often involves implementing or configuring systems which can have associated costs, and it doesn't address the fundamental issue of *how much* data needs protection like minimization does.

Implementing a data loss prevention (DLP) solution can be very effective but is typically a significant investment in terms of software, hardware, configuration, and ongoing management, making it less cost-effective than simply minimizing the data itself.