Study guide 16: Data protection, compliance and personnel policies
Domain 5: Security Program Management & Oversight · Not started
Main exam topics
Governance, policies, standards and roles; risk assessment and treatment; vendor oversight; compliance and privacy; audits and assessments; security awareness; annualized loss expectancy = single loss expectancy × annual rate of occurrence.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 75 minutes
By the end of this lesson you will be able to:
- Classify data and identify regulated types
- Protect data at rest, in transit and in use; explain sovereignty
- Describe compliance reporting, privacy rights and consequences
- Apply personnel policies and security awareness training
Topic 16A — Data classification and compliance
Classifications range from public to confidential, restricted and critical. Regulated data includes PII, PHI and cardholder data; intellectual property and trade secrets also need protection. Data states: at rest, in transit, in use. Data sovereignty and geographic restrictions require data to stay within jurisdictions. Methods: encryption, hashing, masking, tokenization, segmentation and permission restrictions. Compliance requires internal and external reporting; failures bring fines, sanctions, reputational damage and loss of license. Privacy roles include controller and processor; subjects have rights such as the right to be forgotten. Data retention and inventory policies limit what is kept.
Topic 16B — Personnel policies
Acceptable use, separation of duties, job rotation, mandatory vacation, least privilege, background checks, NDAs and clean desk. Onboarding and offboarding manage access. Security awareness training covers phishing simulations, anomalous behavior recognition, password management, removable media, social engineering and remote work; measure with reporting rates and recurring campaigns.
Saved