Study. uk . com
  1. Home
  2. All questions
  3. Question 190

CISSP study material · question 190 of 500

An analyst determines that a dataset does not meet the definition of personally identifiable information, and proposes to remove it from the protection programme entirely. What does NIST SP 800-122 advise?

  1. Retain it under the same controls until the next annual review.
  2. Reclassify it as public and publish it to reduce holdings.
  3. Remove it, since the publication covers only personal data.
  4. Still consider whether the data is sensitive or carries risk, and decide what protection it needs.
Show the answer

Answer: D. Still consider whether the data is sensitive or carries risk, and decide what protection it needs.

SP 800-122 says that even where information is judged not to be personal data, the organisation should consider whether it is sensitive or carries organisational or individual risk.

Source: NIST SP 800-122 (NIST) — SP 800-122 > 2.1 footnote 14

Challenge yourself on this topic → Study as cards