Data Security & Privacy Compliance Flashcards

Under HIPAA's Security Rule, which of the following is classified as an 'administrative safeguard'?

Answer: Workforce training and security awareness programs

HIPAA's Security Rule categorizes workforce training and security awareness programs as administrative safeguards, distinct from physical or technical safeguards.

A company collects consumer data in California. Under CCPA, what right allows consumers to prevent a business from selling their personal information?

Answer: Right to opt-out

The CCPA grants California consumers the right to opt-out of the sale of their personal information to third parties.

Which data classification level typically requires the strictest access controls and encryption standards?

Answer: Top Secret / Restricted

Top Secret or Restricted data requires the strictest controls because unauthorized disclosure could cause severe harm to the organization or individuals.

A penetration tester discovers that an organization stores Social Security Numbers in plaintext in a database. Which control would most directly remediate this risk?

Answer: Applying data-at-rest encryption to the database

Encrypting data at rest ensures that SSNs are unreadable even if an attacker gains direct access to the database files.

Under GDPR, the 'right to be forgotten' is formally known as which right?

Answer: Right to erasure

GDPR Article 17 codifies the 'right to be forgotten' as the right to erasure, allowing individuals to request deletion of their personal data.

Which federal law mandates that financial institutions implement safeguards to protect customer financial information and deliver privacy notices?

Answer: GLBA

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their data-sharing practices and protect sensitive customer data.

An organization must destroy paper records containing PII. Which method best meets NIST SP 800-88 media sanitization guidelines for paper?

Answer: Cross-cut shredding to DIN 66399 P-4 or higher

NIST SP 800-88 recommends cross-cut shredding at a sufficient security level (such as DIN P-4 or higher) to ensure paper records cannot be reconstructed.