Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Developing a Data Protection Control Strategy
The strategy step by step
Choosing controls
| Control | Protects against |
|---|---|
| Encryption (at rest, in transit) | Disclosure if media or traffic is intercepted |
| Access control and least privilege | Unauthorised internal access |
| DLP | Sensitive data leaving through email, web or USB |
| Masking and tokenisation | Exposure in test, analytics or payments |
| Backup and immutability | Loss and ransomware |
Don’t forget copies
- Test and development environments.
- Analytics platforms and data lakes.
- Suppliers and processors.
- Backups and archives.
- Personal devices and cloud drives.
Example. A firm encrypted its production customer database but copied it unmasked into an analytics platform with 200 users. A data discovery scan found it, and masking was applied before the next quarterly copy.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step in a data protection strategy | Discover and classify sensitive data |
| Protect data used in testing | Masking or synthetic data |
| Stop sensitive data leaving by email | DLP |
| Basis for control strength | Data classification |
In short
- A data protection strategy starts with discovering where sensitive data is, including SaaS and shadow IT.
- Owners classify data; controls are applied in proportion to classification.
- Key controls include encryption, access control, DLP, masking, tokenisation and backup.
- Monitoring detects unusual access and movement; response plans handle breaches.
- The strategy is reviewed as data, regulation and threats change.
Exam traps
- Buying a DLP tool before knowing where sensitive data is.
- Encrypting everything equally regardless of value.
- Ignoring data held by suppliers.
- Protecting production data while leaving copies in test and analytics environments.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The strategy step by step
1 / 7