ISC2 CISSP Practice Question

The CISO is emphasizing the Privacy by Design principle, which was developed by Dr. Ann Cavoukian and is now considered a global standard for protection. It advocates for incorporating data protection measures into the design and architecture of systems from the beginning, rather than adding them later as a reaction to problems.

The correct answer involves conducting a data flow assessment during the requirements phase, which allows the team to systematically analyze how personal information will be collected, used, shared, and maintained before any technical decisions are made. This proactive approach helps identify and mitigate risks early, embedding protection into the system architecture itself.

The other options represent reactive approaches that address concerns after design decisions have been made, focus only on compliance documentation without addressing architectural considerations, or implement technical controls without considering broader implications of data handling throughout the entire system lifecycle.