according to the text, which of the following is not a security professional's obligation relating to information protection and unauthorized disclosure?