Mechanisms exist to restrict the use and distribution of sensitive/regulated data.
Does the organization restrict the use and distribution of sensitive/regulated data?