A company's security team notices that sensitive printed documents are frequently left on desks overnight, and unlocked workstations often display confidential information. Which best-practice security policy should the team implement to directly address both issues?