ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityMedium
A software development firm is using an agile methodology and frequently deploys updates to its cloud-native applications. They need to ensure that database backups containing customer PII are securely marked and handled according to their 'Confidential' classification. What is the PRIMARY purpose of 'labeling' these backups?
- ATo visually and programmatically identify the data's sensitivity and handling requirements.
- BTo encrypt the backup files during transit.
- CTo automate the restoration process in case of data loss.
- DTo determine the data owner responsible for the backup.
Show answer & explanationAnswer & explanation
Correct answer: A. To visually and programmatically identify the data's sensitivity and handling requirements.
Labeling (or marking) data is primarily about identifying its classification level and associated handling requirements. This ensures that anyone interacting with the data, whether human or automated system, understands its sensitivity and how it should be protected.
Why the other options are wrong
- B. Labeling defines requirements, but encryption is a separate technical control.
- C. Labeling is for classification and handling, not directly for automation of restoration.
- D. While the data owner defines classification, labeling is the *output* of that decision, applied to the data itself, not for identifying the owner.
Data Labeling (Marking)
The process of applying clear, consistent indicators (labels or markings) to data based on its classification to communicate its sensitivity and required handling procedures.
- Communicates data sensitivity to users and systems.
- Guides appropriate controls for storage, transmission, and access.
- Can be visual (e.g., footers) or programmatic (e.g., metadata tags).
Memory trick: Label it so everyone knows how to handle it.