Privacy in the CC Outline
Key Takeaways
Subdomain 1.1 names privacy as a cybersecurity concept alongside confidentiality, integrity, availability, AAA, and non-repudiation.
Privacy concerns whether personal information is handled appropriately, which is distinct from whether systems are secured.
Collect and keep only the personal information the purpose needs.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 1.1, checked 2026-10-22.
Privacy Is Listed as a Concept
The 2026 outline lists privacy under subdomain 1.1, with confidentiality, integrity, availability, AAA, and non-repudiation. For CC, privacy means the appropriate handling of personal information: whether it is needed, who may see it, and how long it is kept.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 1.1, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Recognizing a Privacy Problem
A system can be secure and still mishandle personal information. Collecting data that the service does not need is a privacy problem even if the data is well protected. A scenario that asks whether information should be collected, shared, or kept is a privacy question; a scenario about who can open the file is more likely an access question. Answer the question the scenario actually asks.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.1: Confidentiality
- 1.1: Integrity
- 1.1: Availability
- 1.1: Authentication, Authorization, Accounting (AAA)
- 1.1: Non-repudiation
- 1.1: Privacy
Common Traps
A common trap is naming the wrong objective. If the scenario is about who acted, the objective is accountability, not availability. Name the objective the scenario states before choosing among controls.
A team wants to collect customers' birth dates, but the service does not need them. Which concept is the main issue?
Privacy, because personal information is collected without a need
Availability, because the service may slow down when extra personal fields are stored on the same database
Non-repudiation, because customers may later deny that they entered the birth dates in the form
Integrity, because the birth dates may be wrong if customers type them incorrectly into the form
Sections you finish are checked off in the contents.