Isaca Certification CDPSE Isaca Study Notes

Data flow diagrams (DFDs) are most valuable for illustrating the locations and movements of personal data across systems and processes, which is essential for compliance mapping and controls. Mapping at rest (C) or transit (D) are subsets of this broader view, while (A) is vague.

“DFDs identify where personal data resides and flows, supporting compliance and risk management.”

A peer-to-peer (P2P) system architecture is a network model where each node (peer) can act as both a client and a server, and communicate directly with other peers without relying on a centralized authority or intermediary. A P2P system architecture best supports anonymity for data transmission, by providing the following advantages:

It can hide the identity and location of the peers, by using encryption, pseudonyms, proxies, or onion routing techniques, such as Tor1 or I2P2. These techniques can prevent eavesdropping, tracking, or censorship by third parties, such as Internet service providers, governments, or hackers.

It can distribute the data across multiple peers, by using hashing, replication, or fragmentation techniques, such as BitTorrent3 or IPFS4. These techniques can reduce the risk of data loss, corruption, or tampering by malicious peers, and increase the availability and resilience of the data.

It can enable the peers to control their own data, by using consensus, validation, or incentive mechanisms, such as blockchain5 or smart contracts. These mechanisms can ensure the integrity and authenticity of the data transactions, and enforce the privacy policies and preferences of the data owners.

The need-to-know basis principle is a security principle that states that access to personal data should be limited to those who have a legitimate purpose for accessing it. The need-to-know basis principle helps to protect data privacy by minimizing the exposure of personal data to unauthorized or unnecessary parties, reducing the risk of data breaches, leaks, or misuse. The need-to-know basis principle should be applied when designing a role-based user access model for a new application, by defining clear roles and responsibilities for different users, granting access rights based on their roles and functions, and enforcing access controls and audits to monitor and verify data access. References: : CDPSE Review Manual (Digital Version), page 105

Before any processing, CDPSE stresses lawfulness: identify and document the appropriate legal basis and processing purpose(s). Security controls (C), algorithmic techniques (B), and aggregation (D) are important but secondary to establishing a lawful basis and purpose limitation.

Key CDPSE-aligned phrasing (short extract): “Processing requires a lawful basis and defined purposes prior to collection/use.”