CISSP Asset Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Collecting only the PII required for the stated function.

  Why this is correct

  This action directly embodies the Privacy by Design principle of data minimization, which mandates that organizations collect only the absolute minimum amount of personal identifiable information (PII) necessary to achieve a specified, legitimate purpose. By limiting data collection at the outset, the organization proactively reduces the attack surface and potential impact of a data breach, aligning with PBD's foundational, preventative approach rather than reactive measures.

• ✗

  Anonymizing data after collection.

  Why it's wrong here

  While anonymizing data after collection is a valuable technique for reducing privacy risks associated with data processing and sharing, it does not address the initial scope of data collection. Privacy by Design emphasizes proactive measures to prevent privacy harms from occurring, meaning that the focus should be on *not collecting* unnecessary PII in the first place, rather than attempting to mitigate the risks of over-collection post-factum.

• ✗

  Obtaining explicit consent from users.

  Why it's wrong here

  Obtaining explicit consent is a crucial legal and ethical requirement for processing personal data, ensuring individuals have control over their information. However, it primarily addresses the lawfulness of processing and transparency, rather than the architectural design principle of data minimization inherent in Privacy by Design. PBD seeks to embed privacy safeguards into the system's core functionality, independent of user consent mechanisms, by limiting the data collected and processed from the outset.

• ✗

  Collecting all possible PII in case it is needed later.

  Why it's wrong here

  Collecting all possible PII, even if its future utility is uncertain, directly contradicts the fundamental Privacy by Design principle of data minimization. This 'collect now, ask questions later' approach significantly increases the organization's data footprint, thereby expanding the potential attack surface and the scope of harm in the event of a data breach or misuse. PBD advocates for purpose limitation and necessity, not speculative data hoarding.

Go deeper

Related to this question