ISC2 Certified in Cybersecurity (CC)Security OperationsEasy
An organization is migrating its data to a new cloud service provider. To ensure compliance with data privacy regulations, they must categorize all data based on its sensitivity and regulatory requirements before migration. Which data management practice is being performed?
- AData retention
- BSecure disposal
- CData handling
- DData classification
Show answer & explanationAnswer & explanation
Correct answer: D. Data classification
Data classification is the process of categorizing data based on its sensitivity, value, and regulatory requirements. This step is crucial for determining appropriate security controls, handling procedures, and retention policies.
Why the other options are wrong
- A. Data retention defines how long data must be kept, which is a consequence of classification, not the classification itself.
- B. Secure disposal deals with the permanent removal of data, occurring at the end of its lifecycle.
- C. Data handling refers to the procedures for processing, storing, and transmitting data after it has been classified.
Data Classification
The process of categorizing data based on its sensitivity, value, and regulatory requirements to determine appropriate security controls.
- Assigns labels (e.g., Public, Internal, Confidential).
- Informs access controls, encryption, and handling procedures.
- Essential for regulatory compliance and risk management.
Memory trick: Classify first, then handle, retain, and dispose.