Study. uk . com
  1. Home
  2. All questions
  3. Question 517

CISM study material · question 517 of 1000

Why does NIST treat training records as carrying heightened sensitivity?

  1. They often form part of employment or contract records and can feed performance evaluations or disciplinary consequences
  2. They contain the organisation's own security control details, which an attacker could then use to plan around each of the defences that are already in place
  3. They are shared with the training vendor by default, which places them outside the organisation's own security boundary altogether
  4. They are subject to indefinite retention requirements, so the exposure only grows with every further year that the records are kept
Show the answer

Answer: A. They often form part of employment or contract records and can feed performance evaluations or disciplinary consequences

SP 800-50r1 warns that learning data on employees is sensitive because of its context: it sits in employment or contract records and can be attached to appraisal or to consequences for not completing required training.

Source: NIST SP 800-50 Rev. 1 (NIST) — Sec. 2.4.1 Measurements

Challenge yourself on this topic → Study as cards