Organizations typically require sensitive data such as personally identifiable information (PII) to be encrypted or secured when stored at rest.

### Why this is right The handling matrix specifies that personally identifiable information stored internally should be encrypted or secured. The same internal-storage guidance is given for intellectual property. ### The concept Data-handling requirements depend on the type of information and what is being done with it. Emailing, sending data to outsiders, storing it internally, and destroying it are distinct use cases. A DLP policy can use such rules to detect handling that does not meet organizational requirements. ### The other options - **False**: This would contradict the handling matrix's internal-storage rule for this data type. ### Terms - **Personally identifiable information (PII)**: Information that identifies or can be associated with an individual. - **Encryption**: Transforming data so it cannot be read without the appropriate key or process. ### Remember Apply the matrix by checking both the data category and the action being taken.