Study. uk . com
  1. Home
  2. All questions
  3. Question 184

CISSP study material · question 184 of 500

Two lists hold identical fields - name, address and telephone number. One is newsletter subscribers, the other is undercover officers. A reviewer says they must carry the same PII impact level. Why is that wrong?

  1. Context of use can give the same fields different impact levels, because the harm from disclosure differs sharply.
  2. The officers' list is a national security system and falls outside SP 800-122.
  3. Impact level is set by field sensitivity alone, and the reviewer has misread the fields.
  4. Impact level is set by quantity, so the larger list is always rated higher.
Show the answer

Answer: A. Context of use can give the same fields different impact levels, because the harm from disclosure differs sharply.

SP 800-122 uses context of use precisely for this: the same data elements may be assigned different impact levels because the potential harm from a breach differs.

Source: NIST SP 800-122 (NIST) — SP 800-122 > 3.2 Context of Use

Challenge yourself on this topic → Study as cards