Encryption is the best answer because it directly addresses the confidentiality of the documents by making them unreadable to unauthorized users while having no impact on the availability of the documents for authorized users who have the decryption key. Implementing access controls also addresses confidentiality by restricting access to authorized users, but it does not inherently render the data unreadable to unauthorized users who may bypass these controls. Intrusion detection systems are focused on identifying security breaches, which relates more to detection than to maintaining confidentiality or availability. Backup systems are primarily related to ensuring availability in the event of data loss and do not enforce confidentiality of data during regular access.