Episode 39 — A.5.33–5.34 — Protection of records; Privacy & PII protection
A.5.33 mandates that records—authoritative evidence of activities performed—are protected so they remain authentic, reliable, and usable for as long as needed. For the exam, note the required controls: classification, retention rules, integrity safeguards, controlled access, and secure disposal. Records may include logs, audit trails, training attestations, incident reports, contracts, and design reviews, each carrying evidentiary value for audits and investigations. A.5.34 focuses on privacy and protection of personally identifiable information (PII), requiring that processing be lawful, fair, and transparent, with appropriate technical and organizational measures commensurate to risk. Candidates should be able to articulate how privacy principles intersect with security controls to protect individuals’ rights while supporting business operations.
Implementation uses records retention schedules aligned to legal and contractual requirements, write-once or append-only storage for critical logs, time synchronization for trustworthy timelines, and access controls with immutable audit trails. For privacy, organizations maintain data inventories, purpose limitations, minimization strategies, role-based access, encryption, and consent or notice mechanisms where applicable. Privacy by design introduces DPIAs for high-risk processing, de-identification where feasible, and data subject request workflows tested for timeliness and completeness. Pitfalls include retaining data longer than needed, incomplete log coverage in cloud services, weak key management, and privacy notices that do not match actual processing. Strong programs track DSAR response times, deletion SLA adherence, log integrity verification, and exceptions granted by counsel. Candidates should be ready to explain how records and privacy controls integrate with incident response, supplier agreements, and management review to form a defensible, people-centric compliance posture. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
