The Policy That Locked Out the Field Team
A construction firm deploys a document security policy: all PDFs containing cost data must be password-protected and restricted from printing or copying. The policy is applied by default to a shared template library. Within a week, 40 site supervisors cannot open bid packages on their phones, and the estimating team cannot copy quantities into their spreadsheet - they are retyping hundreds of line items. Meanwhile, an auditor asks for evidence that cost PDFs are actually protected, and nobody can produce a report. The firm has 300 users and an Adobe business subscription with admin console access.
1. Diagnose the policy failure and propose a corrected permission model.
Read the worked answer
The policy conflated confidentiality with control, and applied one rule to everyone.
Failure 1 - Mobile access. Password-protected PDFs often fail on mobile viewers that lack the right decryption or prompt handling. Site supervisors need read access on phones; a password gate breaks that.
Failure 2 - Copy restriction. The estimating team's job is to extract quantities. Blocking copy forces retyping, which introduces errors and wastes hours. The restriction protected nothing the team wasn't already authorized to see.
Corrected model - role-based permissions:
- Estimators: full access including copy/extract, because extraction is their function.
- Site supervisors: open/read on mobile, no print of cost data.
- External parties: password or rights-managed protection, no copy, no print.
Apply protection at the distribution step based on recipient, not as a blanket default on the template library. The library itself should be access-controlled, not individually password-locked.
2. The auditor wants evidence. What should the firm put in place?
Read the worked answer
The firm currently has no visibility - protection may or may not be applied, and nobody can prove it. Evidence requires two things:
- A defined, enforced policy with a clear rule: which documents, which recipients, which protections. A policy that lives only in a wiki is unenforceable.
- Reporting/audit capability. The admin console should be used to track document protection events and access. Configure it so protection actions are logged, then produce a periodic report showing coverage (e.g., 'X of Y cost PDFs distributed externally were protected').
Also retain the audit trail of who accessed protected documents, which is often what auditors actually want - not just that a password existed, but that access was controlled and recorded. Set a recurring review so the evidence is generated continuously rather than reconstructed under audit pressure.