nerdexam
(ISC)2

CGRC · Question #680

According to NIST SP 800-60v2r1, intellectual property protection information type may be categorized as low but trade secrets are categorized as: Response:

The correct answer is A. Moderate for confidentiality. NIST SP 800-60v2r1 categorizes trade secrets as 'Moderate' for confidentiality, acknowledging the significant impact unauthorized disclosure could have. This contrasts with general intellectual property, which might be classified as 'Low' for confidentiality.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

According to NIST SP 800-60v2r1, intellectual property protection information type may be categorized as low but trade secrets are categorized as:

Response:

Options

  • AModerate for confidentiality
  • BHigh for confidentiality
  • CModerate for integrity
  • DModerate for availability

How the community answered

(31 responses)
  • A
    94% (29)
  • B
    3% (1)
  • C
    3% (1)

Why each option

NIST SP 800-60v2r1 categorizes trade secrets as 'Moderate' for confidentiality, acknowledging the significant impact unauthorized disclosure could have. This contrasts with general intellectual property, which might be classified as 'Low' for confidentiality.

AModerate for confidentialityCorrect

According to NIST Special Publication 800-60 Volume 2 Revision 1, 'Guide for Mapping Types of Information and Information Systems to Security Categories,' trade secrets are typically categorized as 'Moderate' for confidentiality. The unauthorized disclosure of trade secrets can lead to a significant adverse impact, such as substantial financial loss or a severe competitive disadvantage, thus warranting a moderate confidentiality categorization.

BHigh for confidentiality

While trade secrets are highly sensitive, NIST SP 800-60v2r1 generally provides a baseline categorization of Moderate for confidentiality, reserving High for impacts causing severe or catastrophic harm.

CModerate for integrity

While integrity is important for trade secrets, the primary and most direct security concern addressed by their definition as 'trade secrets' is typically their confidentiality, not integrity.

DModerate for availability

While availability is important for all information, the core risk classification for 'trade secrets' as an information type under NIST SP 800-60v2r1 primarily focuses on their confidentiality impact.

Concept tested: NIST SP 800-60 information categorization

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf

Topics

#NIST SP 800-60#Information Classification#Confidentiality Impact#Trade Secrets

Community Discussion

No community discussion yet for this question.

Full CGRC Practice