4.3.4.1 Confidentiality

Return to Securability

About

Return to Glossary

Confidentiality is usually covered by the use of Confidentiality Agreement or Non-Disclosure Agreement (NDA) which defines a set of rules or a promise limiting access or places restrictions on certain types of information. Areas that have legal agreements covering confidentiality are:

Legal ConfidentialityMedical ConfidentialityClinical and Counseling PsychologyCommercial ConfidentialityBanking ConfidentialityPublic Policy ConcernsReligious ConfidentialityAs a rule of thumb, it is best to treat all Personal Identifiable Information (PII) as confidential and to secure it (i.e., require authentication and authentication to access the data, log access to the data).

The US nist describe the kinds of data that should be treated as PII1) Erika McCallister Tim Grance and Karen Scarfone, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), Special Publication 800-122, April 2010, Accessed on 13 August 2020, https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf as:

Name, such as full name, maiden name, mother‘s maiden name, or aliasPersonal identification number, such as:Social security number (SSN), Passport number, Driver‘s license number, Taxpayer identification number, Patient identification number, and Financial account numberCredit card numberNIST also identifies information which potentially can be used to identify people:

Address information, such as street address or email addressAsset information, such as Internet Protocol (IP) or Media Access Control (MAC) address or other host-specific persistent static identifier that consistently links to a particular person or small, well-defined group of peopleTelephone numbers, including mobile, business, and personal numbersPersonal characteristics, including photographic image (especially of face or other distinguishing characteristic), x-rays, fingerprints, or other Biometric image or template data (e.g., retina scan, voice signature, facial geometry)Information identifying personally owned property, such as vehicle registration number or title number and related informationInformation about an individual that is linked or linkable to one of the above (e.g., date of birth, place of birth, race, religion, weight, activities, geographical indicators, employment information, medical information, education information, financial information).

DIDO Specifics

Return to Glossary