An information security program shall be designed to do all of the following, EXCEPT:

Virginia Code § 38.2-623 mandates insurers to implement information security programs to safeguard nonpublic personal information, aligning with the NAIC’s Model Regulation for Privacy. These programs must ensure confidentiality (option B), protect against threats or hazards (option C), and prevent unauthorized access (option D)—all core objectives to secure data against breaches or misuse. Option A (ensure policyholder access without substantial inconvenience) is not a requirement of the security program; while Virginia Code § 38.2-610 allows policyholders to request their information, this is a separate consumer right, not a security program goal. The study guide likely details these mandates in a privacy section, emphasizing protection over access facilitation, as security focuses on safeguarding, not convenience. For example, encryption (B, D) and risk assessments (C) are standard, but streamlining access (A) could even conflict with security if overly permissive, making A the exception.