An organization has initiated a project to enhance privacy protections by improving its information security controls. Which of the following is the MOST useful action to help define the scope of…

Question

Options

• AReview recent audit reports on the internal control environment
• BIdentify databases that contain personal data
• CIdentify databases that do not have encryption in place.
• DReview proposed privacy rules that govern the processing of personal data

• A
  3% (1)
• B
  14% (4)
• C
  7% (2)
• D
  76% (22)

Explanation

Reviewing proposed privacy rules that govern the processing of personal data is the most useful action for defining project scope because regulatory and legal requirements establish what must be protected and how. Privacy rules define obligations around data collection, processing, storage, and rights of data subjects-directly shaping what controls are needed and what falls within scope. Identifying personal data databases (B) or unencrypted ones (C) are execution-level steps taken after scope is defined, not scope-defining actions. Reviewing audit reports (A) reveals past gaps but does not establish the regulatory baseline that drives scope.

No community discussion yet for this question.