An organization encrypts stored data but lets every application account decrypt it. What should the practitioner evaluate?

1. Only the number of encrypted disks
2. Effective key access and authorization boundaries
3. Only the algorithm's published key length
4. Automatic classification of all encrypted data as nonsensitive