Information Security and Data Management
What this domain tests
Security controls in a service context, and the governance of data as an asset: classification, quality, lifecycle, protection and legal obligation. Items ask which control applies, which standard clause is engaged, or which data quality dimension is failing.
Core rules
- CIA triad plus authenticity, accountability and non-repudiation frame every control discussion.
- ISO/IEC 27001:2022 specifies an ISMS: leadership, risk assessment and treatment, a Statement of Applicability, and Annex A with 93 controls in four themes - organisational (37), people (8), physical (14), technological (34). Certification covers the management system, not a product.
- Access control: least privilege, need-to-know, role-based access, segregation of duties, and joiner-mover-leaver reviews.
- Data management (DAMA-DMBOK) spans governance, architecture, modelling, storage, security, integration, documents, master and reference data, warehousing, metadata and quality. Quality dimensions: accuracy, completeness, consistency, timeliness, uniqueness and validity.
- Lifecycle and law: classify data (public, internal, confidential, secret), then apply retention, masking, encryption, and disposal. In China, the Cybersecurity Law, Data Security Law and Personal Information Protection Law, together with classified protection (等保 2.0) levels 1–5, impose duties on personal data and important data.
Worked example
A marketing team wants full customer records in a test environment. The data is personal, so the control is not simply "encrypt the table": pseudonymise with a masking tool, restrict the extract to named testers, log access, delete it after the test window, and record the decision in the Statement of Applicability evidence. That answer covers purpose limitation, least privilege, retention and traceability - encryption alone addresses only one dimension.
Traps that cost marks
- Quoting the 2013 Annex A (114 controls across 14 clauses) instead of the 2022 structure.
- Assuming backup replaces archiving, or that encryption replaces access control.
- Treating the Statement of Applicability as a copy of Annex A rather than justified inclusions and exclusions.
- Confusing data quality dimensions - completeness (missing values) versus validity (wrong format) is a frequent discrimination.
- Forgetting that personal data has purpose limitation, not just confidentiality requirements.