topic Re: CCSP - Data Life Cycle in Tech Talk

CCSP - Data Life Cycle

Spirnia — Mon, 28 Apr 2025 21:03:03 GMT

Does data classification happen during the Create phase or the Store phase?

What is the reasoning behind your answer?

Re: CCSP - Data Life Cycle

akkem — Tue, 29 Apr 2025 00:57:32 GMT

Classification should happen as early as possible, when data is created or acquired— to ensure data is properly protected before store and throughout lifecycle.

Re: CCSP - Data Life Cycle

bmuzhanje — Tue, 29 Apr 2025 09:17:49 GMT

Data should be classified during data creation phase this then helps us to apply commensurate in-storage controls based on the data class.

Re: CCSP - Data Life Cycle

Spirnia — Tue, 29 Apr 2025 09:38:21 GMT

Thank you both for your replies!

I agree.

I noticed ChatGPT said during the store phase. So, I wanted to double check.

The official online curriculum also says during the create phase.

ChatGPT

Re: CCSP - Data Life Cycle

dcontesti — Tue, 29 Apr 2025 21:46:45 GMT

I have a slightly different thought on when Data should be Classified. I believe that data should be classified at is creation/collection however is should be reviewed periodically to potential reclassify data in light of compliance requirements, organisational changes , or even as the data is being used in new applications.

Re: CCSP - Data Life Cycle

nkeaton — Tue, 29 Apr 2025 22:37:23 GMT

@Spirnia This is a perfect example of why the CC’s Verify; then trust is very true. Data must be classified at creation; otherwise you wouldn’t know what to do with it. The data owner is responsible for classifying their data. For ISC2 exams, we must know the answers according to ISC2, not Google or an AI engine. This is also why people do the worst in the domain that they actually work in because they don’t answer according to ISC2. ISC2 is definitely the boss on exams as to what is right.

Re: CCSP - Data Life Cycle

Spirnia — Tue, 29 Apr 2025 22:55:26 GMT

I very much like and agree with your take on it @dcontesti

Thank you for your very thoughtful reply!

I agree that reviewing and reclassifying based on compliance and organizational changes and any additional insight one may gain after the original classification during creation/collection is of utmost importance to the data life cycle. And that moving to new systems would be another good place to check on the correct classification.

And creation/collection is certainly more complete than simply creation.

Thanks again for your input!

Re: CCSP - Data Life Cycle

Spirnia — Tue, 29 Apr 2025 23:02:10 GMT

@nkeaton you are correct in that if you do the tasks on a regular basis, you might not answer according to ISC2, instead, answer from experience, and get a few questions wrong.

I do double check on some concepts that I feel uncertain about.

Thank you for your reply!

I am glad I posted my question to this forum.

Re: CCSP - Data Life Cycle

dcontesti — Wed, 30 Apr 2025 15:12:25 GMT

I use Collection as data may "travel" throughout an organisation, Take for example: Data related to the weight of a specific product, while in the production area, that data, may be classified as Internal, however if the Financial department now requires that piece of data as part of their reporting, the classification could change to be "confidential" as it may be combined with other data. It may not change, but the receiving department is now the Data Owner and needs to classify it.

As to (ISC)2 being the expert, I tend to disagree. Most materials, the organisation puts together are done by volunteers. Exams as an example are developed by a group of knowledgeable individuals. The questions and distractors are discussed and a consensus is reached. This is why most exams include pre-test items (let's see how they perform) and if they make it to the exam, the questions again are reviewed based on candidate comments and the stats related to the item. Additionally, some topics are very difficult to put into question format. If you ever have the good fortune to participate in developing exams (a great experience that helps expand your knowledge base and also a great networking opportunity), you may find yourself in a position, that you can write a question and develop three distractors but not be able to find the fourth (not always the easiest job).

If I based my work on everything that I see or read, I potentially might not have my job very long. At times, we need to rely on experience but during an exam, we need to rely on what we have seen in a book or a video. As an example, we recently saw that here on the forum, where a question on Cloud Security was brought into question and we were told, that "training" is now under review for rewrite.

Again, MHO

Re: CCSP - Data Life Cycle

Spirnia — Wed, 30 Apr 2025 15:33:29 GMT

@dcontesti thank you again for your reply!

I like how you defined collection. I had not thought of it quite in that manner before.

I was the one who questioned crypto shredding earlier. And I wondered how that got into the official curriculum as it was written in multiple locations.

I am glad ISC2 is taking a second look at that topic in their curriculum.

It is also true that 'textbook' know-how may not be the 'right' thing to do on the job. And in our ever changing world, the written curriculum may very well be far behind times. But, it is also true that that is what the exam requires of us to know.

I am sure exam writing is a very interesting experience for all involved! I always wonder how certain questions are formulated!

Re: CCSP - Data Life Cycle

nkeaton — Thu, 01 May 2025 01:28:45 GMT

@dcontestiNot sure that you understand classification and categorization in this context. Think labels. It is absolutely the responsibility of the data owner to do that for their data. I agree that ISC2 is not the expert, but CSA is, and they helped ISC2 develop the CCSP. So it is very valid and correct. As to the poster, they absolutely need to follow ISC2 definitions until they pass the exam. People often do the worst in the domain that they work in because answer from experience rather than what ISC2 wants. This is why I would never recommend Google, AI engines, or other easy resources for studying. They proved that point well with asking AI.

Re: CCSP - Data Life Cycle

dcontesti — Thu, 01 May 2025 14:44:32 GMT

Using Google, AI, etc. has assisted many folks when in a quandary on a specific topic while some have thirty to forty feet of bookshelves lined with books from various authors (that sometimes contradict each other) but assist us with gaining an answer and finally, some of us have over thirty-five years in the industry and rely on our experience/knowledge.

The point that is missing is that (ISC)2 and CSA, asks the candidate to "Choose the best answer from those presented". Exam questions should be clear, distractors (answers) should never be made up and never intended to trick a candidate.

As to CSA being the experts, they are also a group of volunteers (that come to consensus) who develop exams and provide trainings and guidance.

Re: CCSP - Data Life Cycle

nkeaton — Thu, 01 May 2025 14:58:11 GMT

@dcontesti They are not good for studying for exams. I like to use the example of the lawyer who used it for precedents in a case. This is why I like CC's Verify; then trust. He did not do that. The judge recognized that they were not valid. So much for professionalism. As far as volunteers for developing questions, I can assure you that we are all professionals or would not be accepted to do that. We sign NDAs and work very hard. I feel like it is important to give back to the community and help others.

Re: CCSP - Data Life Cycle

dcontesti — Thu, 01 May 2025 15:19:06 GMT

@nkeaton

No where in any of my replies did I suggest that they were good for studying, so please do not put words in my mouth.

The original question asked " where does data classification begin" and explain your response. Which is what I did. As I have developed a data classification system for a Global company that employees over 300M people, I offered my opinion and justification. If you disagree with my definition, that's fine.

As to Exam Development, I understand the process far more that you would expect. You see at one point during my volunteer days (when the organisation had not money), I actually ran workshops, had NDAs signed and work very hard, this all prior to Casey and folks like Vehbi, Tony, etc. I am truly aware of the process.

You seem to enjoy putting words in my mouth. I never said that the volunteers do not work hard. Believe it or not (ISC)2 would not be where it is without their volunteers.

Please stop putting words in my mouth, it shows as unprofessional and a need to be continuously right

FYI: I am adding the admins here, so they are fully aware @Kaity

Re: CCSP - Data Life Cycle

learningdaily — Thu, 01 May 2025 15:53:30 GMT

In my opinion, data classification should begin at the creation of the data. Before this, it is essential to have a well-defined classification guide to simplify the decision of which label to choose.

Defining data at the "storage" phase defeats the purpose of classification.

For example, if the classification guide includes categories such as proprietary, public, and confidential, each with specific system requirements for storing their respective data types, the data creator must label the data appropriately from the start, or else the system on which the data is created and stored may not meet the requirements of the data type.

I am interested in hearing others' opinions.

Re: CCSP - Data Life Cycle

Kaity — Thu, 01 May 2025 16:04:56 GMT

@nkeaton Please be respectful in this forum. Folks are welcome to disagree with each other, but do not make accuasations or disaparaging remarks. This behavior will not be tolerated.

Thanks all!

Re: CCSP - Data Life Cycle

nkeaton — Thu, 01 May 2025 18:33:10 GMT

@dcontesti I never said that you were recommending AI for studying. I don't recommend it because it definitely won't follow ISC2, and as I indicated people don't check the results which is why I like CC's Verify; then trust. I am sorry that you think like you do about me. I agree that volunteering is very important. As far as professionalism, I do not think that I have ever insulted you and have zero need to be right. Only people who think that they are better than others do that. I do not think that I am smarter or better than anyone else. I am also not a name dropper. I help hundreds of people every year with their cybersecurity needs and enjoy giving back to the profession.