Data Handling: Classification, Labeling, Masking, and Sanitization
Key Takeaways
Subdomain 5.1 names data handling as classification, labeling, masking, and sanitization.
Classification comes before labeling: decide the sensitivity, then mark it.
Masking hides sensitive values; sanitization removes data so it cannot be recovered.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 5.1, checked 2026-10-22.
Classification and Labeling
Subdomain 5.1 names data handling with the examples classification, labeling, masking, and sanitization. Classification assigns a sensitivity level to data. Labeling marks the data so that people handle it correctly. Classification must come first, because a label depends on the level.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 5.1, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Masking and Sanitization
Masking replaces or hides sensitive values while the data remains in use, for example in a test copy. Sanitization removes data from storage media so that it cannot be recovered before disposal or reuse. A scenario about discarding a drive points to sanitization; a scenario about showing a value to a tester points to masking.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 5.1: Data handling (e.g., classification, labeling, masking, and sanitization)
- 5.1: Encryption (e.g., symmetric, asymmetric, hashing, quantum resistant cryptography)
Common Traps
A common trap is using the wrong handling step. Classify and label first; sanitization removes data for disposal or reuse, while masking hides values that remain in use.
A company is about to reuse a storage drive that held customer records. Which data handling step applies?
Sanitization
Masking
Labeling
Encryption of the email system
Which items are data handling concepts in the outline? Select all that apply.
Select all that apply
Classification
Labeling
Vulnerability scanning
Masking
When a scenario describes a disposal decision, the sanitization step is the one that matters. When it describes display or test use, masking fits better.
Sections you finish are checked off in the contents.