According to private sector data classification levels, how would salary levels and medical information be classified?
Correct Answer: D
Typically there are three to four levels of information classification used by most organizations: Confidential: Information that, if released or disclosed outside of the organization, would create severe problems for the organization. For example, information that provides a competitive advantage is important to the technical or financial success (like trade secrets, intellectual property, or research designs), or protects the privacy of individuals would be considered confidential. Information may include payroll information, health records, credit information, formulas, technical designs, restricted regulatory information, senior management internal correspondence, or business strategies or plans. These may also be called top secret, privileged, personal, sensitive, or highly confidential. In other words this information is ok within a defined group in the company such as marketing or sales, but is not suited for release to anyone else in the company without permission.
The following answers are incorrect:
Public: Information that may be disclosed to the general public without concern for harming the company, employees, or business partners. No special protections are required, and information in this category is sometimes referred to as unclassified. For example, information that is posted to a company's public Internet site, publicly released announcements, marketing materials, cafeteria menus, and any internal documents that would not present harm to the company if they were disclosed would be classified as public. While there is little concern for confidentiality, integrity and availability should be considered.
Internal Use Only: Information that could be disclosed within the company, but could harm
the company if disclosed externally. Information such as customer lists, vendor pricing,
organizational policies, standards and procedures, and internal organization
announcements would need baseline security protections, but do not rise to the level of
protection as confidential information. In other words, the information may be used freely
within the company but any unapproved use outside the company can pose a chance of
harm.
Restricted: Information that requires the utmost protection or, if discovered by unauthorized
personnel, would cause irreparable harm to the organization would have the highest level
of classification. There may be very few pieces of information like this within an
organization, but data classified at this level requires all the access control and protection
mechanisms available to the organization. Even when information classified at this level
exists, there will be few copies of it
Reference(s) Used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 952-976). Auerbach Publications. Kindle Edition.