A company has recently had sensitive data stolen by a contractor who plugged a flash drive into a server. Which of the following is the BEST method to prevent future occurrences?

Disabling unused physical ports - either in the BIOS/UEFI, via OS-level port management, or with hardware port blockers - provides a technical enforcement control that makes it physically impossible to connect an unauthorized flash drive. This addresses the specific attack vector (physical USB access) directly and cannot be bypassed by a contractor without visible tampering, unlike policy-only controls.

A BIOS password restricts boot configuration changes but does not disable USB ports during normal system operation, so a flash drive can still be used after the system boots.

Chassis locks prevent access to internal components such as expansion cards and drives, but do not block external-facing USB ports that remain accessible on the server's exterior.

A policy-based restriction relies on user compliance and has no technical enforcement mechanism - the same contractor behavior that already occurred can still occur, just in violation of a written policy.