What governs the operational and technical mechanisms necessary to protect personal information?

• A. Privacy
• B. Compliance
• C. Physical Safeguards
• D. Security

Answer: (D)

Protecting personal information hinges on a security program that governs the protective controls used in both processes and technology. Security encompasses the safeguards that keep data confidential, intact, and available. This includes who is allowed to access data (identity management and access controls), how data is protected during transmission and storage (encryption and secure communications), and how potential threats are detected, prevented, and responded to (continuous monitoring, incident response, vulnerability management). It also covers the ongoing governance of these measures—policy, risk assessment, staffing, training, and auditing—to ensure safeguards stay effective over time.

Understanding the other terms helps clarify why security fits best. Privacy is about individuals’ rights and how their data is used and shared, not the nuts-and-bolts protections themselves. Compliance focuses on meeting laws and regulations, which guides what must be done but doesn’t specify the actual protective controls. Physical safeguards protect the physical environment and access to equipment, but they don’t address the full range of digital protective mechanisms. Security, by contrast, is the umbrella concept that covers both the operational and technical mechanisms necessary to defend personal information.