CRISC Question 224

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  C. Mask customer data fields Given the scenario, where a vendor has access to customer data for analysis, the most effective control to protect customer privacy would be to mask or anonymize the customer data fields. Data masking essentially replaces the real customer data with fictitious yet realistic data, thereby preserving the utility of the data for analysis without exposing actual customer information. Option A, "Restrict access to customer data on a 'need to know' basis", could be used in conjunction with data masking, but by itself it may not be sufficient if the vendor needs to access large volumes of data for analysis. Option B, "Enforce criminal background checks", is a useful control in vendor management, but it does not directly address the risk of data leakage once the vendor has access to the data. Option D, "Require vendor to sign a confidentiality agreement", is a contractual control that can help to ensure legal recourse in the event of a data leak. However, it does not actually prevent the leak from occurring in the first place. It's also better to combine this with other technical measures such as data masking.

• Chose A1

  In real life; organizations are just satisfied with "D". Option "C" masking the data fields is a good practice but solely not enough. Restrict the access of the vendor based on access control principles is the best.

• 1

  if its about "MOST effective control to mitigate the risk of customer data leakage", then of those i go with access control. Because MASKING is only anonymizing the data, not protecting.