A. Access to personally identifiable information is limited to those who need it to perform their job.

B. Confidential data must be backed up and recoverable within a 24-hour period.

C. Updates to systems containing sensitive data must be approved before being moved to production.

D. A record of employees with access to insider information must be maintained and those employees may not trade company stock during blackout periods

A. Not installing anti-malware software

B. Updating operating software in a haphazard manner

C. Applying a weak password for access to a mobile device

D. Jailbreaking a locked smart device.

A. Voice recognition and token.

B. Password and fingerprint.

C. Fingerprint and voice recognition

D. Password and token

A. Accounts receivable in the short term

B. Bonds to be held to maturity.

C. Notes receivable in the short term

D. Bonds to be held for sale in the short term.

A. All personal information, by definition is considered to be sensitive, requiring specialized controls.

B. Information is not considered personal if it can only be linked to or used to identify an individual indirectly.

C. Individuals who provide personal information to organizations share in the risk of inappropriate disclosure.

D. Good protection controls remove any restrictions on the quantity of personal information that can be collected

A. Initiation phase

B. Bidding phase

C. Development phase

D. Management phase