Study. uk . com
  1. Home
  2. All questions
  3. Question 189

CISSP study material · question 189 of 500

A privacy programme starts by writing encryption standards for the personal data it knows about. What does NIST SP 800-122 make its first recommendation, and why?

  1. Identify all the personal data in the environment, because an organisation cannot protect what it does not know it holds.
  2. Publish a privacy notice, because notice is a legal precondition.
  3. Set the PII confidentiality impact level, because controls follow from the level.
  4. Appoint a privacy officer, because accountability precedes protection.
Show the answer

Answer: A. Identify all the personal data in the environment, because an organisation cannot protect what it does not know it holds.

SP 800-122 makes identifying all the personal data residing in the environment the first recommendation, using a broad definition to catch as many potential sources as possible.

Source: NIST SP 800-122 (NIST) — SP 800-122 > Executive Summary

Challenge yourself on this topic → Study as cards