"Occupant Emergency Plan (OEP). The OEP is a document providing coordinated procedures for minimizing loss of life or injury and protecting property damage in response to a physical threat. It does not necessarily deal with business systems or IT system functionality, but rather focuses on personnel and property at a specific facility." Pg 666 Hansche: Official (ISC)2 Guide to the CISSP Exam

Encrypting a message provides only one security service. It is Confidentiality.
You must clearly understand all the available choices within cryptography, because different steps and algorithms provide different types of security services:
* A message can be encrypted, which provides confidentiality.
* A message can be hashed, which provides integrity.
* A message can be digitally signed, which provides authentication, nonrepudiation, and integrity.
* A message can be encrypted and digitally signed , which provides confidentiality, authentication, nonrepudiation, and integrity.
Some algorithms can only perform encryption, whereas others support digital signatures and encryption.
When hashing is involved, a hashing algorithm is used, not an encryption algorithm. It is important to understand that not all algorithms can necessarily provide all security services.
Most of these algorithms are used in some type of combination to provide all the necessary security services.
The following answers are incorrect:
Non-Repudiation Regarding digital security, the cryptological meaning and application of non-repudiation shifts to mean:
A service that provides proof of the integrity and origin of data.
An authentication that can be asserted to be genuine with high assurance.
Proof of data integrity is typically the easiest of these requirements to accomplish. A data hash, such as SHA2, is usually sufficient to establish that the likelihood of data being undetectably changed is extremely low. Even with this safeguard, it is still possible to tamper with data in transit, either through a man-in-the-middle attack or phishing. Due to this flaw, data integrity is best asserted when the recipient already possesses the necessary verification information.
The most common method of asserting the digital origin of data is through digital certificates, a form of public key infrastructure, to which digital signatures belong. Note that the public key scheme is not used for encryption in this form, confidentiality is not achieved by signing a message with a private key (since anyone can obtain the public key to reverse the signature). Verifying the digital origin means that the certified/signed data can be, with reasonable certainty, trusted to be from somebody who possesses the private key corresponding to the signing certificate. If the key is not properly safeguarded by the original owner, digital forgery can become a major concern.
Authentication (from Greek: ; real or genuine, from authentes; author) is the act of confirming the truth of an attribute of a single piece of data (datum) or entity. In contrast with Identification which refers to the act of stating or otherwise indicating a claim purportedly attesting to a person or thing's identity, Authentication is the process of actually confirming that identity. It might involve confirming the identity of a person by validating their identity documents, verifying the validity of a website with a digital certificate, or ensuring that a product is what its packaging and labeling claim to be. In other words,
Authentication often involves verifying the validity of at least one form of identification.
AUTHENTICATION FACTORS
The ways in which someone may be authenticated fall into three categories, based on what are known as the factors of authentication: something the user knows, something the user has, and something the user is.
Each authentication factor covers a range of elements used to authenticate or verify a person's identity prior to being granted access, approving a transaction request, signing a document or other work product, granting authority to others, and establishing a chain of authority.
Security research has determined that for a positive authentication, elements from at least two, and preferably all three, factors should be verified. Using two of the three factors is called strong authentication or two factors authentication.
The three factors (classes) and some of elements of each factor are:
the knowledge factors: Something the user knows (e.g., a password, pass phrase, or personal identification number (PIN), challenge response (the user must answer a question), pattern), software token, or phone serving as a software token the ownership factors: Something the user has (e.g., wrist band, ID card, security token, or cell phone with built-in hardware token) the inherence factors: Something the user is or does (e.g., fingerprint, retinal pattern, DNA sequence (there are assorted definitions of what is sufficient), signature, face, voice, unique bio-electric signals, or other biometric identifier).
Integrity Data integrity refers to maintaining and assuring the accuracy and consistency of data over its entire life-cycle, and is a critical aspect to the design, implementation and usage of any system which stores, processes, or retrieves data.
The following reference(s) were/was used to create this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (pp. 829-830).
McGraw-Hill . Kindle Edition.
http://en.wikipedia.org/wiki/Non-repudiation
http://en.wikipedia.org/wiki/Authentication
http://en.wikipedia.org/wiki/Data_integrity

Discussion: If a single employee were permitted to stay in one critical position for an extended period of time without close oversight he or she could carry out fraud undetected.
For this reason it is important to rotate employees between jobs. Another good reason is to get employees experienced on their colleagues' jobs. This way, if an employee were for some reason unavailable to work, their position could be covered.
The following answers are incorrect:
Separation of Duties: This is similar to Job Rotation because critical functions are divided up between employees to avoid and detect fraud. It is incorrect because with Job Rotation, people move between positions to detect fraud or even get better at each position to provide some resiliency for the organization. Separation of Duties is more a preventative measure.
Mandatory Rotations: This is incorrect because of the terminology. There are terms called
Mandatory Vacations and Job Rotation but not mandatory rotations. Be familiar with these terms before trying to pass the exam.
Dual Control: This term describes how a manager would require employees to work together (two or more) on critical actions so that no single employee can cause catastrophic damage. This isn't the correct answer but it is very similar to Job Rotation where an employee rotates between job duties. Dual Control requires employees to work together on critical tasks in hopes of limiting collusion to commit fraud.
The following reference(s) was used to create this question:
Gregg, Michael; Haines, Billy (2012-02-16). CASP: CompTIA Advanced Security
Practitioner Study Guide Authorized Courseware: Exam CAS-001 (p. 245). Wiley. Kindle
Edition.