CISSP: Certified Information Systems Security Professional

Question

An organization has created a method for customers to share information from their wearable devices with one another. Unfortunately, users were not told what collected information would be shared. What technical controls should be implemented to address the privacy issue while still seeking to achieve the organization’s business goals?

Explanation

A privacy-protective default prevents wearable-device information from being disclosed until the user elects to share it. This preserves the sharing capability while giving users control over disclosure; informed notice and consent can be obtained before they opt in. NIST privacy guidance calls for mechanisms that communicate data-processing practices and enable individuals’ data-processing preferences and requests.

Learn more

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ132

Community Discussion