Study. uk . com
  1. Home
  2. All questions
  3. Question 188

CISSP study material · question 188 of 500

A marketing team wants to keep every field it has ever collected in case it proves useful later. Which two practices does NIST SP 800-122 recommend instead? Choose two.

  1. Review existing holdings periodically to see whether they are still relevant and necessary.
  2. Move the surplus fields to a separate system with a lower impact level.
  3. Collect, use and retain only the personal data the business purpose actually needs.
  4. Encrypt the surplus fields rather than deleting them.
Show the answer

Answer: C. Collect, use and retain only the personal data the business purpose actually needs.
A. Review existing holdings periodically to see whether they are still relevant and necessary.

SP 800-122 asks organisations to minimise the personal data they use, collect and retain, and to review holdings periodically, because a smaller holding means a smaller breach.

Source: NIST SP 800-122 (NIST) — SP 800-122 > Executive Summary

Challenge yourself on this topic → Study as cards