Non-technical Data and Privacy Controls Flashcards
The process of managing information over its life cycle from creation to
destruction
Data Governance
The process of applying confidentiality and privacy labels to information
Data Classification
No restrictions on viewing the data and it presents no risk to
the organization is disclosed to the public at large
Unclassified
Viewing is restricted to authorized persons within the owner
organization or to third parties under a non-disclosure
agreement
Classified
Highly sensitive data that is for viewing only by approved
persons within the organization (and possibly by trusted third
parties under NDA)
Confidential
Information that is valuable and must be protected by severely
restricting its viewing
Secret
Information that would cause grave danger if inadvertently
disclosed
Top Secret
The downgrading of a classification label overtime due to the information no
longer requiring the additional security protections provided by that classification
Declassification
A tag or label to identify a piece of data under a subcategory of a classification
Data Type
The organization of information into preset structures or specifications
Data Format
The location of data within a processing system
▪ Data at rest
▪ Data in motion
▪ Data in use
Data State
Any type of information or asset should consider how a compromise of that information can threaten the three core security attributes of the CIA triad
Legal Requirements
Security controls focus on the CIA attributes of the processing system
Privacy versus Security
A data governance requirement that arises when collecting and processing
personal data to ensure the rights of the subject’s data
Privacy
Personal data cannot be collected, processed, or retained without the individual’s
informed consent
General Data Protection Regulation (GDPR)
Sets forth the requirements for the storage and retention of documents relating
to an organization’s financial and business operations, including the type of
documents to be stored and their retention periods
Sarbanes-Oxley Act (SOX)
Sets forth the requirements that help protect the privacy of an individual’s
financial information that is held by financial institutions and others
Gramm-Leach-Bliley Act (GLBA)
Sets forth the requirements for federal organizations to adopt information
assurance controls
Federal Information Security Management Act (FISMA)
Sets forth the requirements that help protect the privacy of an individual’s health
information that is held by healthcare providers, hospitals, and insurance
companies
Health Insurance Portability and Accountability Act (HIPAA)
Provides guidance on a variety of governance-related topics including fraud,
controls, finance, and ethics and relies on COSO’s ERM-integrated framework
Committee of Sponsoring Organizations of the Treadway Commission (COSO)
The principle that personal information can be collected and processed only for a
stated purpose to which the subject has consented
Purpose Limitation
The principle that only necessary and sufficient personal information can be
collected and processed for the stated purpose
Data Minimization
The principle that countries and states may impose individual requirements on
data collected or stored within their jurisdiction
Data Sovereignty
A set of policies, procedures, and tools for managing the storage of persistent
data
Retention
The process an organization uses to maintain the existence of and control over
certain data in order to comply with business policies and/or applicable laws and
regulations
Data Retention
Refers to information that is kept for a specific purpose outside of an
organization’s data retention policy
Data Preservation
The process of identifying the person responsible for the confidentiality, integrity,
availability, and privacy of information assets
Data Ownership
A senior (executive) role with ultimate responsibility for maintaining the
confidentiality, integrity, and availability of the information asset
Data Owner
A role focused on the quality of the data and associated metadata
Data Steward
A role responsible for handling the management of the system on which the data
assets are stored
Data Custodian
A role responsible for the oversight of any PII/SPI/PHI assets managed by the
company
Privacy Officer
You can outsource a service or activity, but not the legal responsibility for it
Data Sharing
A contractual agreement setting out the detailed terms under which a service is
provided
Service Level Agreement (SLA)
An agreement used by federal agencies to set out a security risk awareness
process and commit the agency and supplier to implementing security controls
A contract that sets forth the legal basis for protecting information assets
between two parties
Non-Disclosure Agreement (NDA)
An agreement that sets forth the terms under which personal data can be shared
or used
Data Sharing and Use Agreement
