ISC2 Certified in Cybersecurity (CC)Security PrinciplesMedium
A government agency is updating its data handling procedures to comply with new legislation that mandates strict controls over personally identifiable information (PII). The agency must ensure that only authorized personnel can view sensitive citizen data, and that this data is protected from unauthorized disclosure. Which security principle is the primary focus of this mandate?
- AConfidentiality
- BAvailability
- CIntegrity
- DNon-repudiation
Show answer & explanationAnswer & explanation
Correct answer: A. Confidentiality
The mandate's focus on 'only authorized personnel can view sensitive citizen data' and 'protected from unauthorized disclosure' directly pertains to Confidentiality, which ensures that information is accessible only to those authorized to have access.
Why the other options are wrong
- B. Availability ensures data and systems are accessible when needed, not who can view them.
- C. Integrity protects data from unauthorized modification, not disclosure.
- D. Non-repudiation ensures one cannot deny an action, which is unrelated to preventing unauthorized viewing.
Confidentiality
The security principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. It protects sensitive data from unauthorized access and viewing.
- Part of the CIA triad
- Achieved through encryption, access controls, data masking
- Crucial for sensitive data like PII and intellectual property
Memory trick: CIA: Confidentiality, Integrity, Availability – the core of secure information.