2 cissp ® Official Study Guide Eighth Edition

Defining Sensitive Data
Sensitive data is any information that isn’t public or unclassified. It can include confidential, 
proprietary, protected, or any other type of data that an organization needs to protect due to 
its value to the organization, or to comply with existing laws and regulations.
Personally Identifiable Information
Personally identifiable information (PII) 
is any information that can identify an individual. 
National Institute of Standards and Technology (NIST) Special Publication (SP) 800-122 
provides a more formal definition:
Any information about an individual maintained by an agency, including
(1) any information that can be used to distinguish or trace an individual’s 
identity, such as name, social security number, date and place of birth, 
mother’s maiden name, or biometric records; and
(2) any other information that is linked or linkable to an individual, such 
as medical, educational, financial, and employment information.
The key is that organizations have a responsibility to protect PII. This includes PII 
related to employees and customers. Many laws require organizations to notify individuals 
if a data breach results in a compromise of PII.

---

Identify and Classify Assets 
161
Protection for personally identifiable information (PII) drives privacy and 
confidentiality requirements for rules, regulations, and legislation all over 
the world (especially in North America and the European Union). NIST SP 
800-122,
Guide to Protecting the Confidentiality of Personally Identifiable 
Information (PII)
, provides more information on how to protect PII. It is 
available from the NIST Special Publications (800 Series) download page: 
http://csrc.nist.gov/publications/PubsSPs.html