Your Organization Has a New Requirement for Annual Security Training: Which Practice Is NOT Compliant?

The answer

In this scenario, the non-compliant practice is using employees' Social Security Numbers (SSNs) as the identifier to track annual security-training completion. SSNs are among the most sensitive categories of Personally Identifiable Information (PII), and privacy rules require that you minimize their collection and use. The compliant fix is to track completion using a unique employee ID or training-record number that isn't sensitive on its own.

The principle behind this is data minimization: collect and use the least sensitive information necessary to accomplish the task. Tracking who finished a training course does not require an SSN — a payroll ID, network username, or employee number does the job with far less risk. Using an SSN where a benign identifier would work needlessly exposes the organization to identity-theft and breach liability.

Why the SSN option is the wrong practice

SSNs are considered high-risk PII because a single number, if exposed, unlocks identity theft, financial fraud, and access to many other records. If a spreadsheet or learning-management system tracking training were breached, SSNs would turn a minor incident into a serious one. Key reasons SSNs fail the compliance test:

• They are stand-alone sensitive identifiers. Unlike an employee ID, an SSN has value and meaning outside the organization.
• They violate minimization. The task (confirming training completion) can be done without them.
• They expand breach impact and legal exposure. Regulations and agency policy specifically discourage using SSNs as record locators.

Why the other options are compliant

Typical "compliant" distractors in this question are things like:

• Using a unique employee ID to track completion — Compliant. This is the recommended alternative; it identifies the record without exposing sensitive PII.
• Storing records on an approved, access-controlled system — Compliant. Limiting access and using authorized systems is exactly what safeguarding requires.
• Sharing completion status only with those who need it — Compliant. This follows the need-to-know principle.

All of these follow good PII hygiene, which is why they are not the answer. The question asks which practice breaks the rules, and only the SSN option does.

The bigger picture: safeguarding PII

PII is any information that can identify a specific person — name, SSN, date of birth, biometric data, and combinations of quasi-identifiers. Safeguarding PII rests on a few habits: collect only what you need, use the least sensitive identifier possible, restrict access to need-to-know, store it on approved systems, and dispose of it properly. Replacing SSNs with non-sensitive unique IDs is a textbook application of these rules. The compliant answer isn't just "use an employee ID" — it's understanding why: minimizing high-risk PII shrinks the damage any future breach can do.