Which practices are commonly used for protecting sensitive information across data at rest, in transit, and in use?

• A. Classification, encryption, access controls, secure transport, secure processing, minimization, and proper disposal
• B. Encrypt data only at rest
• C. Use passwords as the only control
• D. Back up data weekly

Answer: (A)

Protecting sensitive information across data at rest, in transit, and in use requires a layered approach that covers how data is stored, moved, and processed. Classification guides how strongly we must protect data based on its sensitivity. Encryption helps keep data confidential whether it’s stored or traveling across networks, and it’s a fundamental safeguard for protecting data in use when combined with secure processing techniques. Access controls ensure only authorized people or systems can reach the data, while secure transport specifically guards data as it moves between locations. Secure processing focuses on protecting data while it’s being used, such as in memory or during computation. Minimization reduces the amount of data we actually collect and retain, lowering exposure risk, and proper disposal makes sure data isn’t recoverable when it’s no longer needed. When these elements work together, they provide comprehensive protection across all states of data.

The other options fall short because they address only a narrow aspect of protection. Encrypting data only at rest ignores data in transit and data in use. Relying on passwords as the sole control leaves data unprotected against many threats and bypasses encryption, access controls, and secure processing. Backups alone focus on availability and recovery, not on keeping data confidential or securely processed.