Which of the following best explains why sensitive data should be encrypted at rest on laptops?

The primary purpose of encrypting sensitive data at rest on portable devices like laptops is to protect the information from unauthorized disclosure in the event the physical device is lost or stolen. Full Disk Encryption (FDE) or file-level encryption ensures that even if a malicious actor gains physical possession of the storage media, they cannot read, extract, or compromise the sensitive data without the correct decryption keys or credentials. This mitigates the highest risk associated with mobile computing assets.

Option A: Encryption at rest does not prevent authorized end users from copying data; Data Loss Prevention (DLP) solutions and endpoint controls are required for that purpose.

Option C: While encryption helps organizations achieve regulatory compliance, the fundamental technical and security reason for its implementation is to prevent data disclosure upon physical theft.

Option D: Encryption at rest on a local laptop provides confidentiality, not integrity, and it does not protect data while it is traversing the company network.

- NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices, Section 2.1: Threats to Data at Rest. https://doi.org/10.6028/NIST.SP.800-111

- CompTIA CySA+ CS0-004 Official Study Guide, Chapter 14: Data Security, Section: Encryption at Rest.