Study. uk . com
  1. Home
  2. All questions
  3. Question 181

CISSP study material · question 181 of 500

A privacy officer is told the PII confidentiality impact level is simply the FIPS 199 confidentiality level under another name. What distinguishes the two, under NIST SP 800-122?

  1. The PII level replaces the FIPS 199 level for any system holding personal data.
  2. The PII level applies only to systems categorised high under FIPS 199.
  3. The PII level uses a four-point scale rather than three.
  4. The PII level measures potential harm to the individuals concerned, not only harm to the organisation.
Show the answer

Answer: D. The PII level measures potential harm to the individuals concerned, not only harm to the organisation.

SP 800-122 keeps the PII confidentiality impact level separate from the FIPS 199 level; it indicates the harm that could result to the subject individuals as well as the organisation.

Source: NIST SP 800-122 (NIST) — SP 800-122 > Executive Summary

Challenge yourself on this topic → Study as cards