A team is setting the PII confidentiality impact level for a new dataset. Which three factors does NIST SP 800-122 offer for that decision? Choose three.

Answer: D. Legal or regulatory obligations to protect the data.
A. How readily the data identifies specific individuals.
C. The context of use for which the data was collected.

SP 800-122 lists identifiability, quantity, data field sensitivity, context of use, obligations to protect confidentiality, and access to and location of the data as factors.

Source: NIST SP 800-122 (NIST) — SP 800-122 > 3.2 Factors for Determining PII Confidentiality Impact Levels