Which of the following is the most appropriate test to assess the privacy risks associated with an organization’s workstations?