Which of the following is NOT a security principle proposed in the 1997 For the Record report?

• A. Use two-factor authentication
• B. Establish security education and training
• C. Develop policies for software discipline
• D. Avoid storage on portable drives

Answer: (D)

The question tests understanding of what security principles the 1997 For the Record report emphasized. That guidance centers on people and policy-driven controls: strengthening identity verification (two-factor authentication), educating and training users about security, and establishing clear policies for how software is used and managed. These ideas reflect a focus on reducing human risk and ensuring proper behavior and governance around systems.

Avoiding storage on portable drives is not listed as a fundamental principle in that report. While portable storage concerns are addressed in security practice, the report did not frame a blanket rule against storing data on portable drives as one of its core principles. Instead, if portable drives are used, appropriate controls (such as encryption and access restrictions) would typically be applied within the broader security framework.

So, the statement about avoiding portable storage is the one not proposed as a core principle in that report.