Which practice best reduces data exposure when handling SOPs?

• A. Data minimization
• B. Publishing all SOPs publicly
• C. Data encryption and access controls
• D. Storing copies in unencrypted USB drives

Answer: (A)

Data minimization means keeping only what you truly need to run and document your SOPs, and disposing of unnecessary data as soon as it’s no longer needed. By shrinking the amount of information you store and retain, you directly limit the amount that could be exposed in a breach or misuse. This reduces the attack surface, makes governance simpler, and lowers risk from the outset because there’s less data to protect, classify, and eventually purge. While encryption and access controls are important for protecting data that exists, they don’t reduce the volume of data you hold. Publishing all SOPs publicly or storing copies on unencrypted USB drives would increase exposure rather than minimize it.