Home / CPA Course / ISC

Confidentiality and privacy

ISC Chapter 15 · Area II · Blueprint II.C

Security keeps attackers out; confidentiality and privacy decide how sensitive data is handled by everyone who is allowed in. Brightwater holds supplier contracts, pricing plans, customer addresses and payroll details, and PayLoom holds the salaries of thousands of people. Priya and Sam work through encryption from the ground up, the difference between confidentiality and privacy, how developers and testers can work with realistic data without exposing real people, how data loss prevention catches leaks, what a breach really costs, how to handle sensitive data from collection to deletion, and finally how a SOC 2 auditor tests confidentiality and privacy controls and walks through the procedures behind them.

In this chapter

1. Encryption fundamentals
2. Confidentiality versus privacy
3. Protecting confidential data in development and testing
4. Data loss prevention
5. What a data breach really costs
6. Handling sensitive data from collection to deletion
7. Testing confidentiality and privacy controls in a SOC 2

This chapter has 7 lessons, 50 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

• Encryption
• confidentiality versus privacy
• obfuscation and tokenization
• data loss prevention
• cost of a breach
• secure handling across the data life cycle

Chapter 14: Testing security controls · Chapter 16: Incident response