Which of the following should Joe, a security manager, implement to reduce the risk of employees working in collusion to embezzle funds from his company?

A privacy policy defines how the organization handles personal data and has no direct mechanism for detecting or preventing employee collusion or financial fraud.

Least privilege limits access to only what is needed for a job role, which can reduce the attack surface but does not specifically address collusion between employees who both have legitimate access.

An acceptable use policy defines permitted uses of company resources and sets behavioral expectations but does not create a control that actively uncovers collusion or embezzlement.

Mandatory vacation policies are specifically designed as a fraud-detection control. When an employee is forced to take leave, another person must perform their duties, which breaks up any collusion scheme and makes it likely that irregularities such as embezzlement will be discovered by the covering employee or through the resulting audit trail.