Pll stands for personally identifiable information, which is any data that can be used to identify a specific individual. Examples of Pll include name, address, phone number, email address, social security number, passport number, driver's license number, etc. IP address and email address are both Pll because they can be used to trace the identity and location of a person. Medical record and test result values, name and year of birth, and x-ray and blood type are not Pll by themselves, but they can become Pll if they are combined with other data that can link them to a specific individual. References = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition, Chapter 10: Project Security, page 331. CompTIA Project+ Certification Exam Objectives, Domain 4: Project Security, Objective 4.1: Given a scenario, apply security best practices to a project, Sub-objective: Identify and classify Pll.

Customer relationship management (CRM) software would be the best to use to store information related to business transactions. CRM software is a type of software that helps businesses manage their interactions and relationships with current and potential customers. CRM software can store and organize information such as customer contact details, purchase history, preferences, feedback, complaints, etc. CRM software can help businesses improve customer service, satisfaction, loyalty, retention, and revenue1

Multifactor authentication (MFA) is a security method that requires users to provide two or more pieces of evidence to verify their identity before accessing a system. MFA can use different types of factors, such as something the user knows (e.g., password, PIN, security question), something the user has (e.g., token, smart card, mobile device), or something the user is (e.g., fingerprint, face, voice). MFA provides a layered approach to logging in to systems that contain an organization's most valuable intellectual property, as it makes it harder for unauthorized users to gain access by compromising one factor alone. MFA can also prevent phishing, brute force, and credential theft attacks12. References = CompTIA Project+ PK0-005 Certification Study Guide,

Evaluating the project is an activity that should be used in the closing phase of a project to support the project triple constraint. This involves reviewing the project plan, deliverables, and outcomes to ensure they meet the project objectives and requirements. References: CompTIA Project+ Study Guide Section 4.4.4

The percentage of risk investments with defined business cases is a metric that measures how well the information security program aligns with the operational objectives of the organization. It indicates how many of the security-related investments are justified by a clear analysis of the expected benefits, costs, and risks, and how they support the business goals and priorities. This metric can help the organization optimize its security spending, demonstrate the value of security to the stakeholders, and align the security strategy with the business strategy1. References = Performance Measurement Guide for Information Security, Section
3.2.3, page 16; Key Performance Indicators for Security Governance, Part 1, Section 3, page 3.