CCSP Study Guide Questions with Verified
Correct Answers
Privacy Act 1986
Data stored outside of US remains in control of US Gov-Patriot Act
Data Protection Act 1998- UK
Data stored outside of EU must be protected
Regulation of Investigatory Powers (RIPA) 2000
UK based
G-CLOUD Initiative- UK based
Government which enabled public services to use Cloud
Safe Harbor
Is a joint agreement between US and EU to prevent the disclosure of sensitive data.
What contradicts EU Data Protection Act.
Data stored in US is subject to US law. Data stored in EU is subject to EU legislation. Data
stored outside of US by US company is still subject to US law.
Data sharing is strictly controlled in the EU, what can violate it?
Patriot Act permits access to data owned by US companies, regardless of location.
OECD (Organization for Economic Cooperation and Development)
Guidelines for Security of IS and Networks.
OECD Collection Limitation Principle
,Requires any entity that gathers personally identifiable information (PII) about a person to
restrict data collection to only information that is necessary for the transaction, and only with
the knowledge and permission of the individual
OECD Data Quality Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
ensure that the data remains valid and accurate and allows for corrections by the data subject
OECD Purpose Specification Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
clearly state the explicit purpose for which the PII will be used.
OECD Use Limitation Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
restrict the use of that PII to that which was permitted by the data subject and the reason
given when it was collected.
OECD Security Safeguards Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
protect that data against unauthorized access and modification.
OECD Openness Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
allow that person to access the information.
eDiscovery
Investigation tool to assist in legal matter (provision of evidence), detect, audit, analyze
unintentional, illegal access to sensitive data, and regulatory audits. When properly
, implemented it supports identification and dispersal of data and information assets. It could
reveal security and PII breaches. It also govern data assets in accordance with defined
security/storage policy.
ISO/IEC 27037
Digital Evidence Handling
ISO/IEC 27050
Electrically Stored Information (ESI) that deals with the discovery process phases.
Identification, Preservation, Collection, Processing, Review, and Production.
Electronic Discovery Reference Model (EDRM)
Is similar to ISO/IEC 27050 for discovery process phases. Identification, Preservation,
Collection, Processing, Review, Analysis, Production, and Presentation.
NIST SP 800-86 System Management of Forensic Data
Lists procedural requirements, Information Governance (Preparation for eDiscovery),
Identification (Locating sources of data), and Preservation (digital data is protected, example
are hashes on originals and work on copies), Collection (gathering of digital data), Processing
(Filtering ESI and converting to a more suitable structure), Review (evaluating ESI for
relevance and privilege), Analysis (evaluating ESI for patterns, content, etc), and Presentation
(producing a report for legal purposes).
EU Directive 95/46/EC - The Data Protection Directive
Through Transparency, the right to know when your data is being processed, Legitimate
Purpose, data processing should be limited to current purpose, Proportionality, data
processing should be limited to required-only data.
Correct Answers
Privacy Act 1986
Data stored outside of US remains in control of US Gov-Patriot Act
Data Protection Act 1998- UK
Data stored outside of EU must be protected
Regulation of Investigatory Powers (RIPA) 2000
UK based
G-CLOUD Initiative- UK based
Government which enabled public services to use Cloud
Safe Harbor
Is a joint agreement between US and EU to prevent the disclosure of sensitive data.
What contradicts EU Data Protection Act.
Data stored in US is subject to US law. Data stored in EU is subject to EU legislation. Data
stored outside of US by US company is still subject to US law.
Data sharing is strictly controlled in the EU, what can violate it?
Patriot Act permits access to data owned by US companies, regardless of location.
OECD (Organization for Economic Cooperation and Development)
Guidelines for Security of IS and Networks.
OECD Collection Limitation Principle
,Requires any entity that gathers personally identifiable information (PII) about a person to
restrict data collection to only information that is necessary for the transaction, and only with
the knowledge and permission of the individual
OECD Data Quality Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
ensure that the data remains valid and accurate and allows for corrections by the data subject
OECD Purpose Specification Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
clearly state the explicit purpose for which the PII will be used.
OECD Use Limitation Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
restrict the use of that PII to that which was permitted by the data subject and the reason
given when it was collected.
OECD Security Safeguards Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
protect that data against unauthorized access and modification.
OECD Openness Principle
Requires any entity that gathers personally identifiable information (PII) about a person to
allow that person to access the information.
eDiscovery
Investigation tool to assist in legal matter (provision of evidence), detect, audit, analyze
unintentional, illegal access to sensitive data, and regulatory audits. When properly
, implemented it supports identification and dispersal of data and information assets. It could
reveal security and PII breaches. It also govern data assets in accordance with defined
security/storage policy.
ISO/IEC 27037
Digital Evidence Handling
ISO/IEC 27050
Electrically Stored Information (ESI) that deals with the discovery process phases.
Identification, Preservation, Collection, Processing, Review, and Production.
Electronic Discovery Reference Model (EDRM)
Is similar to ISO/IEC 27050 for discovery process phases. Identification, Preservation,
Collection, Processing, Review, Analysis, Production, and Presentation.
NIST SP 800-86 System Management of Forensic Data
Lists procedural requirements, Information Governance (Preparation for eDiscovery),
Identification (Locating sources of data), and Preservation (digital data is protected, example
are hashes on originals and work on copies), Collection (gathering of digital data), Processing
(Filtering ESI and converting to a more suitable structure), Review (evaluating ESI for
relevance and privilege), Analysis (evaluating ESI for patterns, content, etc), and Presentation
(producing a report for legal purposes).
EU Directive 95/46/EC - The Data Protection Directive
Through Transparency, the right to know when your data is being processed, Legitimate
Purpose, data processing should be limited to current purpose, Proportionality, data
processing should be limited to required-only data.
