(ISC)2 Certified in Cybersecurity Practice Exam

What is defined as the unauthorized access or disclosure of personally identifiable information?

1. Breach

2. Incident

3. Violation

4. Exposure

The correct answer is: Breach

A breach is specifically defined as the unauthorized access or disclosure of personally identifiable information (PII). This term encompasses a wide range of security incidents where sensitive data is accessed or shared without permission, which can lead to significant consequences for individuals, organizations, and regulatory compliance. In the context of cybersecurity, breaches typically trigger legal and regulatory obligations for notification and remediation, given that they compromise the integrity and confidentiality of sensitive information. In contrast, an incident refers to any event that might compromise the security of information but does not necessarily imply that unauthorized data access has occurred. A violation generally pertains to breaches of rules or policies rather than the specific act of unauthorized access or disclosure. Exposure, while similar in terms of risk, does not inherently imply unauthorized access; it can also refer to situations where sensitive information is inadequately protected, increasing the risk of unauthorized access but not confirming that it has occurred. Therefore, breach accurately encapsulates the act of unauthorized access and disclosure of PII.