nerdexam
(ISC)2

CGRC · Question #391

During the assessment of a new system, the ISO mentioned that if unauthorized modification or destruction of medical information in the system occurred, it could result in potential loss of life…

The correct answer is C. SC medical information = (confidentiality, MODERATE), (integrity, HIGH), (availability, HIGH). The scenario describes a system with essential protected health information where unauthorized modification or destruction could cause loss of life, indicating a high impact on integrity and availability.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

During the assessment of a new system, the ISO mentioned that if unauthorized modification or destruction of medical information in the system occurred, it could result in potential loss of life because the system hosts essential protected health information. Which of the following is the BEST categorization for the information type? Response:

Options

  • ASC medical information = (confidentiality, MODERATE), (integrity, LOW), (availability, LOW)
  • BSC medical information = (confidentiality, MODERATE), (integrity, MODERATE), (availability,
  • CSC medical information = (confidentiality, MODERATE), (integrity, HIGH), (availability, HIGH)
  • DSC medical information = (confidentiality, MODERATE), (integrity, MODERATE), (availability,

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    15% (5)
  • C
    74% (25)
  • D
    9% (3)

Why each option

The scenario describes a system with essential protected health information where unauthorized modification or destruction could cause loss of life, indicating a high impact on integrity and availability.

ASC medical information = (confidentiality, MODERATE), (integrity, LOW), (availability, LOW)

Low impact for integrity and availability is incorrect, as 'loss of life' signifies a severe, high impact.

BSC medical information = (confidentiality, MODERATE), (integrity, MODERATE), (availability,

Moderate impact for integrity and availability is incorrect, as 'loss of life' indicates a critical, high impact, not merely moderate.

CSC medical information = (confidentiality, MODERATE), (integrity, HIGH), (availability, HIGH)Correct

Loss of life due to unauthorized modification (integrity) or destruction (availability) of essential protected health information explicitly defines a 'HIGH' impact level for both integrity and availability, as per NIST FIPS 199. Medical information typically requires 'MODERATE' confidentiality.

DSC medical information = (confidentiality, MODERATE), (integrity, MODERATE), (availability,

Moderate impact for integrity and availability is incorrect, as 'loss of life' indicates a critical, high impact, not merely moderate.

Concept tested: NIST FIPS 199 impact categorization (integrity, availability)

Source: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf

Topics

#Information Classification#CIA Triad#Risk Assessment#Protected Health Information (PHI)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice