Data Handling Policy and Classification
Key Takeaways
Subdomain 5.1 names classification, labeling, masking, and sanitization as data handling.
Subdomain 5.3 names a data handling policy that implements the Incident Response Plan.
Classify the data first, then apply the handling rule that matches its level.
Sanitize storage before disposal or reuse so that the data cannot be recovered.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomains 5.1 and 5.3, checked 2026-10-22.
What the Policy Covers
Subdomain 5.1 names data handling with classification, labeling, masking, and sanitization. Subdomain 5.3 names a data handling policy implementing the Incident Response Plan (IRP). The policy tells people how to treat each class of data, including when it may be shared, masked, or disposed of.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 5.1 and 5.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Classify, Then Handle
Classification assigns a sensitivity level, and labeling marks the data with that level. The handling rule follows the level: more sensitive data has a smaller set of people who may access it and stricter rules for sharing. Masking applies when data is used outside its normal setting, such as a test copy. Sanitization applies when storage is disposed of or reused, and it must remove the data so that it cannot be recovered.
Connecting to Incident Response
The outline ties the data handling policy to the Incident Response Plan. When an incident involves data, the response follows the handling rule for that data's classification, and the response record notes what was done with it.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 5.1: Data handling (e.g., classification, labeling, masking, and sanitization)
- 5.1: Encryption (e.g., symmetric, asymmetric, hashing, quantum resistant cryptography)
- 5.3: Data handling policy implementing Incident Response Plan (IRP)
- 5.3: Incident Response (IR) exercises (e.g., testing, tabletop)
Common Traps
A common trap is using the wrong handling step. Classify and label first; sanitization removes data for disposal or reuse, while masking hides values that remain in use.
A storage drive that held the most sensitive classified data is being reused. Which handling step applies?
Sanitization so that the data cannot be recovered
Labeling the drive with a new classification label so that the next user knows what it previously held
Masking the drive contents so that the sensitive values appear as partial characters on the screen
Renaming the files on the drive to new names that hide the original folder structure from the reuser
Match each data handling term to its meaning.
Match each item on the left with the correct item on the right
Classification
Labeling
Masking
Sanitization
Sections you finish are checked off in the contents.