Asset Security - Objectives

• Understand key asset terms such as assets, information, data, resources, etc.
• Explain how security controls are dictated by the value of assets, including information.
• Understand that information assets that organizations need to protect based on the value of those assets to the organization.
• Explain how asset classification drives the protection of assets based on value.
• Describe the asset lifecycle.
• Understand how data classification and categorization applies to the asset lifecycle.
• Understand the importance of establishing accountability and responsibilities for information ownership and custodianship.
• Explain account abilities and responsibilities for protection of assets by owner, custodians, stewards, controllers, and processors.
• Explain key terms associated with asset protection.
• Understand how privacy of personal information is affected by today’s technologies.
• Explain the expectations of subjects according to privacy laws and regulations.
• Explain the importance of the Organization for Economic Cooperation and Development (OECD) guidelines on Privacy Protection.
• Express the eight principles for privacy protection according to the OECD guidelines.
• Understand the concept of collection limitation as it applies to privacy.
• Understand asset retention and how retention policies are driven by organizational requirements.
• Explain the reasons that drive data and records retention, including compliance or organizational requirements.
• Understand the issues associated with long-term storage of assets.
• Define baseline protection.
• Explain how baselines can help an organization achieve minimum levels of security associated with valuable assets.
• Understand how baselines include security controls and how to implement them.
• Describe baseline protection and scoping and tailoring in reference to asset protection.
• Understand the different data states and explain how to secure each.
• Explain the difference between end-to-end and link encryption as it relates to data in motion.
• Understand how media requires controls to protect its content.
• Understand labeling and marking requirements of assets that have been classified.
• Understand how the handling of media and assets that have been classified should be allowed only to those that are authorized.
• Understand how storing, retention, and destruction of assets is dictated by classification.
• Explain methods used to clear, purge, and destroy data.