When protecting the confidentiality of information assets, the MOST effective control practice is the:

A. awareness training of personnel on regulatory requirements.
B. enforcement of a need-to-know access control philosophy.
C. utilization of a dual-factor authentication mechanism.
D. configuration of read-only access to all users.