An external auditor visits the human resources department and performs a physical security assessment. The auditor observed documents on printers that are unclaimed. A closer look at these documents…

Flipping documents face down only conceals the immediate exposure without resolving the underlying policy violation or preventing future occurrences of sensitive PII being left unattended.

Shredding the documents removes the immediate risk but does not address the fundamental issue of HR personnel violating privacy policies by leaving sensitive PII unattended on printers.

Retrieving and labeling the documents, then returning them to an unattended printer, still poses a risk of PII exposure and does not resolve the systemic non-compliance with data privacy policies.

Reporting the policy violation to the human resources manager is the most appropriate action because it addresses the systemic issue of personnel failing to adhere to data privacy policies, rather than just the immediate incident. This escalation ensures that management can investigate the root cause, reinforce training, and implement corrective measures to prevent future PII exposure.