Information Security, Confidentiality, and Privacy
Domain 3 covers Information Security, Confidentiality, and Privacy. CITP questions test whether you can select controls based on risk, protect sensitive data, and distinguish a security incident from a privacy obligation.
Risk-based control selection
Risk is likelihood times impact. Controls can be preventive (access restrictions, firewalls), detective (logging, IDS, reconciliation), or corrective (restore, incident response). Defense in depth layers controls, and least privilege and need-to-know limit blast radius. NIST CSF 2.0 organizes outcomes as Govern, Identify, Protect, Detect, Respond, and Recover. An IDS alerts; an IPS blocks.
Protecting confidentiality
Encryption protects data in transit (TLS) and at rest, but only if key management is sound. Tokenization and masking reduce exposure in non-production systems. Classification, DLP, and retention schedules limit where sensitive data lives. Multifactor authentication combines factors: something you know, have, or are.
Privacy versus confidentiality
Privacy governs how personal data is collected, used, shared, retained, and deleted, including notice, consent, and data-subject rights. Confidentiality protects any sensitive information, including trade secrets, from unauthorized disclosure. GDPR applies to EU data subjects regardless of company location and requires notification to the supervisory authority within 72 hours of a breach likely to pose a risk to rights and freedoms; individuals are notified without undue delay where risk is high. CCPA/CPRA grants California consumers rights to know, delete, and opt out of sale or sharing.
Worked example
A laptop with 5,000 customer records is stolen. The disk is encrypted and the key was not stored with the device.
Reasoning: treat it as a confidentiality incident, not automatically a notifiable breach. Contain by revoking credentials and remote-wiping; assess likelihood and impact; document the decision. Encryption that renders data unintelligible generally removes the GDPR notification duty, but the assessment and internal record are still required. If the disk had been unencrypted, the 72-hour clock would start on discovery.
Traps
- Equating compliance with security.
- Confusing IDS with IPS.
- Eradicating malware before containing the incident.
- Encrypting data without managing or rotating keys.
- Using privacy and confidentiality interchangeably.
- Assuming GDPR only binds EU-established companies.