Questions? Call 1.800.716.8955

Objective 2.2CISSP

Establish information and asset handling requirements

Domain 2 · Asset Security10% of exam

2.2 Establish information and asset handling requirements

We must also establish policies for

The five areas that data handling policies must cover Data handling policies Handling Who, from where, MFA, logging Storage Encryption at rest, physical, labels Declassification When data is no longer required Deidentification Remove or mask personal info Tokenization Pseudo data in the original form
Data handling policies cover how data is accessed and stored, and how it is declassified, deidentified and tokenized.
  • How data is handled

    • How do we determine when somebody is permitted to access a piece of data?

    • Where can they access the data from?

    • What are the requirements for the computer that can access the data?

    • What software can they use?

    • Can they access the data from home?

    • Do we require users to use MFA?

    • How do we log access to the data?

  • How data is stored

    • Is the data encrypted at rest?

    • What kind of algorithm is used to encrypt the data?

    • How is the system secured physically?

    • How is the system labelled?

  • Declassification

    • How do we declassify data when it is no longer required?

    • How do we know when the data is ready to be declassified?

    • Who decides when the data should be declassified?

  • Deidentification

    • How do we remove personal information from the data?

    • How can we remove or mask personal information, but keep the data useful?

  • Tokenization

    • Tokenization is a process for making the data appear like the original, but with pseudo data.

    • We tokenize the data when we want to hide the original data but have it retain its original form so that it can be processed.
Use ← → to move between sections