712-50 Question 338
Single answerDevelop a plan for information security encryption techniquesA newly appointed CISO is developing an enterprise encryption plan for a global healthcare company that stores patient records in on-premises databases, exchanges claims data with partners over public networks, and backs up critical systems to a cloud provider. The board has asked for a plan that reduces the risk of data exposure while remaining operationally sustainable across multiple regions. Which action should the CISO prioritize FIRST to build an effective encryption strategy?
- A
Mandate a single strong encryption algorithm for all systems and require every business unit to implement it immediately
- B
Classify data by sensitivity, map where it is stored and transmitted, and define encryption requirements with associated key management controls for each use case
- C
Purchase hardware security modules for all major sites before identifying which systems handle regulated or high-value data
- D
Encrypt only data in transit because modern data centers and cloud providers already protect data at rest by default
Show answer and explanation
Correct answer: B
Explanation
The best first step in developing a plan for information security encryption techniques is to identify and classify data, understand data flows, and map encryption requirements to business, regulatory, and operational needs. In a CCISO context, the CISO must build policy and strategy before prescribing tools. For a healthcare enterprise, patient data and claims data are high-value and commonly regulated, so the plan should address encryption for data at rest, in transit, and in backup environments, while also establishing key management governance. Widely accepted guidance supports this approach: NIST recommends data categorization and risk-based control selection in SP 800-53 and SP 800-57 emphasizes cryptographic key management planning; ISO/IEC 27001 and 27002 similarly stress information classification, protection of data in transit, and cryptographic controls based on business and compliance requirements. The key executive insight is that encryption succeeds as a program when it is driven by data sensitivity, architecture, and key management discipline, not by isolated product purchases or blanket technical mandates.
- A. Incorrect.
This is incorrect because selecting one algorithm and forcing immediate uniform implementation skips the governance and architecture work needed for an enterprise encryption plan. Different use cases may require different controls, such as transport encryption for partner exchanges, database or storage encryption for patient records, and specialized key management for cloud backups. A sound strategy begins with business and data requirements rather than a one-size-fits-all technical mandate.
- B. Correct.
This is correct because an enterprise encryption plan should start with data classification and data flow understanding. The CISO needs to know what data is regulated or business-critical, where it resides, how it moves, and which threats and compliance obligations apply. From there, the organization can define fit-for-purpose encryption requirements for data at rest, in transit, and in backups, along with key lifecycle controls such as generation, storage, rotation, separation of duties, and recovery. This approach is operationally sustainable and aligns encryption investments to risk.
- C. Incorrect.
This is incorrect because HSMs can be an important part of protecting high-value cryptographic keys, but buying them first is premature. Without identifying regulated data, key custody requirements, and which applications actually need centralized or hardware-backed key protection, the organization risks overinvesting or deploying the wrong architecture. Technology selection should follow classification, risk assessment, and use-case definition.
- D. Incorrect.
This is incorrect because relying on environmental protections or cloud defaults is not sufficient for a comprehensive encryption plan, especially in healthcare. Data at rest can still be exposed through stolen media, administrative compromise, misconfiguration, or provider-side incidents. Claims data, patient records, and backups often require encryption both in transit and at rest, with proper key management, to meet regulatory and contractual expectations.