Data Security, Confidentiality, and Records Retention
This domain tests how firms protect information and keep or destroy records on a defensible schedule.
Core concepts
- Security: confidentiality, integrity, availability; least privilege; multi-factor authentication; encryption at rest and in transit; access reviews; ethical walls.
- Incident response: detect, contain, assess, notify, remediate; preserve evidence; meet breach-notification timelines.
- Vendor risk: due diligence, contract terms, subprocessors, right to audit, and incident obligations.
- Retention schedule by record type and jurisdiction; matter-close process; legal hold suspends destruction.
- Classification: public, internal, confidential, restricted, with handling rules for each.
- Secure disposal with a certificate of destruction.
Worked example
A partner's laptop with client files is stolen. Reasoning: encryption and remote wipe affect whether the incident is a reportable breach; the response includes containing access, assessing the data, notifying per policy and law, and documenting decisions. It is not only an IT ticket because client confidentiality and regulatory duties are engaged.
Traps
Keeping everything forever; destroying records under legal hold; personal email or cloud storage; shared logins; missing vendor clauses; no disposal evidence.