ISC2 Governance, Risk and Compliance (CGRC) Practice Question

While drafting the System Security Plan (SSP) for a new case-management system, you learn that it will store and transmit employees' medical diagnoses and treatment histories. Using the categorization criteria in FIPS 199 and the information-type mappings in NIST SP 800-60, which confidentiality impact level and U.S. CUI marking should you assign to this data before selecting or tailoring security controls?

Low confidentiality impact; mark the data as Public with no special handling label
Moderate confidentiality impact; mark the data Internal Use Only
High confidentiality impact; mark the data as Controlled Unclassified Information (CUI) - Privacy (health information)
Moderate confidentiality impact; mark the data as Controlled Unclassified Information (CUI) under the Privacy category

Report Issue

Answer Description

NIST SP 800-60 identifies medical diagnosis and treatment data as a subtype of personal health information (PHI) and assigns it a High confidentiality impact because unauthorized disclosure could cause severe or catastrophic harm to individuals (for example, loss of employment, denial of insurance, or significant reputational damage). In U.S. federal environments, PHI is also Controlled Unclassified Information within the Privacy category; the standard limited dissemination marking for such data is "CUI//SP-PRVCY." Therefore, the correct classification is High confidentiality impact with the CUI Privacy (health information) marking. Lower impact levels or non-CUI markings would not satisfy federal guidance.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.