Exam CISSP topic 1 question 309 discussion

Agreed - One way of providing Confidentiality is trought encryption.

Under SSAE 18 (specifically the SOC 2 Trust Services Criteria), the confidentiality principle focuses on protecting sensitive information from unauthorized access. The best control to meet this objective is storage encryption, which ensures that even if data is accessed or stolen, it cannot be read without the proper decryption key.

B. Storage encryption Storage encryption is the BEST control to ensure the confidentiality of data, as it protects data from unauthorized access by encrypting it.

The correct answer is B. Storage encryption. Explanation: The Statement on Standards for Attestation Engagements 18 (SSAE-18) is an attestation standard developed by the American Institute of Certified Public Accountants (AICPA) for reporting on controls at service organizations. The confidentiality category of SSAE-18 addresses the protection of information from unauthorized disclosure. Storage encryption is the best control to meet the confidentiality category requirements, as it ensures that data stored on a device or in a database is encrypted, making it unreadable to unauthorized individuals. Even if the storage medium is compromised, the encrypted data remains protected from unauthorized access and disclosure.