CISSP: Certified Information Systems Security Professional

Question

An organization is developing an enterprise system that uses attribute-based access control (ABAC). To prevent unintended exposure, what should organizations implement to ensure the appropriate handling of personally identifiable information (PII) and enforcement of PII regulations throughout the enterprise?

Explanation

A training program gives personnel the knowledge and role-specific skills needed to handle PII in accordance with privacy requirements, reducing inappropriate access, use, and disclosure. NIST guidance recommends appropriate training for everyone granted access to PII and notes that privacy laws and regulations may specifically require such training.

Learn more

NIST SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ43

Community Discussion