Study. uk . com
  1. Home
  2. All questions
  3. Question 183

CISSP study material · question 183 of 500

A dataset covers only twenty individuals, and an analyst proposes lowering its PII impact level on that basis. What does NIST SP 800-122 say about using quantity this way?

  1. Quantity is disregarded below one thousand records.
  2. Quantity may only raise the impact level, never lower it.
  3. Quantity is the primary factor and may move the level in either direction.
  4. Quantity may lower the level only where the fields are not directly identifying.
Show the answer

Answer: B. Quantity may only raise the impact level, never lower it.

SP 800-122 states explicitly that the PII confidentiality impact level should only be raised and not lowered on the basis of how many individuals are covered.

Source: NIST SP 800-122 (NIST) — SP 800-122 > 3.2 Quantity of PII

Challenge yourself on this topic → Study as cards