1. Home
2. All questions
3. Question 17

CISSP study material · question 17 of 500

A university drafts a single blanket handling rule covering every piece of personally identifiable information it holds, from published faculty office numbers to student health records. The privacy officer objects, citing the federal guidance on protecting such information. What does that guidance direct instead?

• Asset security
• Risk management

1. Decide a protection level for each instance of the information, grounded in the Fair Information Practices.
2. Apply a protection level derived from the system the information resides in rather than from the information itself.
3. Decide a protection level for each academic department, grounded in the volume of records that department processes.
4. Apply the organisation's strongest protection level to every instance of the information the university holds.

Challenge yourself on this topic → Study as cards