ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Regulated private data is governed by specific laws or regulations that impose mandatory privacy and security obligations. Patient medical imaging files (e.g., X-rays, CT scans) are protected health information covered by the HIPAA Privacy and Security Rules in the United States, making them regulated data. Service-level agreement (SLA) documents, in contrast, are contractual instruments that describe performance metrics and obligations agreed to by the parties; their confidentiality is enforced primarily through contract terms rather than sector-specific privacy statutes. The other options either place contractual data first, list two data types that are both typically regulated, or misclassify data whose regulatory status depends on context.