Back to CISSP (CISSP)

Security and Privacy Controls

Ensure compliance with laws and regulations

Security and Privacy Controls subtopic covers the selection, implementation, and assessment of security and privacy controls to comply with laws, regulations, and organizational policies.
5 minutes 5 Questions

Security and Privacy Controls are essential mechanisms for protecting information systems and data in organizations. In CISSP terminology, these controls are the safeguards or countermeasures employed to avoid, detect, counteract, or minimize security risks and privacy concerns. Security controls typically fall into three categories: 1. Administrative Controls: Policies, procedures, and guidelines that define security roles, responsibilities, and expected behaviors. Examples include security policies, risk assessments, and personnel security measures. 2. Technical Controls: Hardware, software, or firmware components that protect systems and data. Examples include firewalls, encryption, access control systems, and intrusion detection systems. 3. Physical Controls: Measures to protect physical facilities and equipment. Examples include barriers, locks, fire suppression systems, and guards. Additionally, controls can be classified by their function: - Preventive: Stop incidents before they occur - Detective: Identify when incidents have occurred - Corrective: Mitigate the impact of incidents - Deterrent: Discourage potential violators - Recovery: Restore operations after incidents - Compensating: Alternative measures when primary controls cannot be implemented Privacy controls specifically address the protection of personally identifiable information (PII) and typically include data minimization, purpose specification, consent mechanisms, and data subject rights protections. The NIST Special Publication 800-53 provides a comprehensive catalog of security and privacy controls organized into 20 families, including access control, audit and accountability, identification and authentication, system and communications protection, and privacy authorization. Effective implementation requires selecting appropriate controls based on risk assessments, regulatory requirements, and organizational needs, followed by regular testing and monitoring to ensure continued effectiveness.

Security and Privacy Controls are essential mechanisms for protecting information systems and data in organizations. In CISSP terminology, these controls are the safeguards or countermeasures employe…

Concepts covered: Security Auditing, Human Resource Security, Incident Response and Disaster Recovery, Security Policies, Security Governance and Risk Management, Encryption and Cryptography, Software and System Security, Intrusion Detection and Prevention, Physical and Environmental Security, Data Classification and Protection

Test mode:
Start practice test
CISSP - Security and Privacy Controls Example Questions

Test your knowledge of Amazon Simple Storage Service (S3)

Question 1

Which of the following is an example of a privacy impact assessment (PIA)?

Correct Answer: An evaluation of a system or application's ability to protect personal information and comply with privacy regulations and policies

A privacy impact assessment (PIA) is a tool used to evaluate a system or application's ability to protect personal information and comply with privacy regulations and policies. A PIA helps to identify potential privacy risks and recommend appropriate controls to mitigate those risks.

Question 2

Which of the following security controls is designed to restrict access to a specific resource to only those who are authorized to use it?

Correct Answer: Access control

Access control is a security control designed to restrict access to a specific resource to only those who are authorized to use it. This can be achieved through multiple mechanisms, such as passwords, tokens, biometrics or smart cards.

Question 3

Which of the following security controls can help prevent social engineering attacks?

Correct Answer: Security awareness training for employees

Security awareness training for employees can help prevent social engineering attacks by educating staff on how to recognize and respond to suspicious emails, phone calls, and other attempts to obtain sensitive information or access to systems.

Go Premium

CISSP Preparation Package (2025)

  • 4537 Superior-grade CISSP practice questions.
  • Accelerated Mastery: Deep dive into critical topics to fast-track your mastery.
  • Unlock Effortless CISSP preparation: 5 full exams.
  • 100% Satisfaction Guaranteed: Full refund with no questions if unsatisfied.
  • Bonus: If you upgrade now you get upgraded access to all courses
  • Risk-Free Decision: Start with a 7-day free trial - get premium features at no cost!
More Security and Privacy Controls questions
132 questions (total)
Start 100 question test