08 Confidentiality

The Confidentiality Trust Services category focuses on protecting information that an organization has designated as confidential.

Examples may include:

Customer Data

Source Code

Trade Secrets

Contracts

Internal Financial Information

Business Strategy

Security Architecture

Proprietary Data

The key question is:

Can the organization demonstrate that confidential information is identified, protected, accessed only by authorized users, securely shared, retained appropriately, and securely disposed of when no longer required?

A strong confidentiality lifecycle looks like:

Identify Data
      ↓
Classify
      ↓
Restrict Access
      ↓
Encrypt
      ↓
Monitor Use
      ↓
Control Sharing
      ↓
Retain
      ↓
Dispose
      ↓
Evidence

For GRC professionals, Confidentiality connects data governance, IAM, encryption, third-party risk, retention, and security monitoring into one assurance model.

Learning Objectives

By the end of this lesson, you will be able to:

• Explain the SOC 2 Confidentiality category.

• Distinguish Confidentiality from Privacy.

• Identify confidential information.

• Build data-classification models.

• Maintain confidential-data inventories.

• Map classification to protection requirements.

• Govern access to confidential information.

• Apply least privilege and need-to-know principles.

• Understand encryption requirements.

• Govern cryptographic keys.

• Protect confidential information in transit.

• Govern data sharing.

• Assess third-party confidentiality controls.

• Define retention requirements.

• Establish secure-disposal controls.

• Monitor confidential-data activity.

• Define appropriate confidentiality evidence.

• Test design and operating effectiveness.

• Build practical Confidentiality artifacts.

1. What Is Confidentiality?

Confidentiality means protecting information from unauthorized disclosure.

Conceptually:

Confidential Information
      ↓
Authorized Users Only
      ↓
Approved Purpose
      ↓
Controlled Access

A confidentiality failure occurs when information is disclosed to someone who should not have access.

2. Confidentiality vs Security

Security is broader.

Security
→ Protect systems and information against threats

Confidentiality
→ Prevent unauthorized disclosure of designated information

A system may be secure in many respects while still having poor confidentiality controls.

3. Confidentiality vs Privacy

Confidentiality and Privacy overlap, but they are not the same.

Confidentiality
→ Protect information designated confidential

Privacy
→ Govern personal information and its lifecycle

Example:

Source Code
→ Confidential
→ Not necessarily personal information

Employee PII may be:

Confidential
+
Privacy-Regulated

4. What Information Is Confidential?

Examples include:

Customer Contracts

Source Code

Pricing Models

Security Designs

Business Plans

API Secrets

Product Roadmaps

Internal Financial Reports

The organization should formally define which information requires confidentiality protection.

5. Information Classification

A common model is:

Public

Internal

Confidential

Restricted

Each classification should have defined handling requirements.

6. Example Classification Model

Classification	Example	Protection Level
Public	Marketing Content	Low
Internal	Internal Procedures	Moderate
Confidential	Customer Contracts	High
Restricted	Critical Secrets	Highest

7. Why Classification Matters

Without classification:

All Data
      ↓
Same Controls

This is inefficient.

With classification:

Data
      ↓
Classification
      ↓
Required Controls

Protection becomes risk based.

8. Classification Policy

A control may state:

Information is classified according to sensitivity, business impact, contractual obligations, and applicable requirements.

9. Classification Criteria

Possible factors:

Business Sensitivity

Customer Commitment

Contract Requirement

Legal Requirement

Competitive Value

Security Impact

10. Data Ownership

Every important information asset should have an accountable owner.

Example:

Customer Contracts
→ Legal

Source Code
→ Engineering

Security Architecture
→ Security

The owner may determine:

Classification

Access

Retention

Sharing

11. Build Data Classification Register

Create:

01 Data Classification Register

Use:

Data Asset	Owner	Classification	Location	Requirement

12. Confidential Data Inventory

Organizations should know where confidential information resides.

Potential locations include:

Databases

Object Storage

SaaS

File Shares

Source Repositories

Endpoints

Backups

Email

13. Why Inventory Matters

If you cannot answer:

Where is our confidential information?

you cannot reliably control:

Access

Encryption

Retention

Sharing

Deletion

14. Build Confidential Data Inventory

Create:

02 Confidential Data Inventory

Use:

Data	System	Owner	Classification	Region	Encryption

15. Data Discovery

Organizations may use:

Manual Inventory

Data Catalog

DLP

Cloud Discovery

Classification Tools

to identify sensitive data.

16. Data Labeling

Some organizations apply labels such as:

CONFIDENTIAL

RESTRICTED

INTERNAL

to documents or data sets.

Labels can support:

Access Control

DLP

Sharing Restrictions

Retention

17. Access Restriction

Confidential information should be accessible only to authorized users.

A common principle is:

Need to Know
+
Least Privilege

18. Need to Know

A user may work for the company but still not need access to every confidential dataset.

Example:

Marketing Employee
≠
Access to M&A Documents

19. Role-Based Access

Use roles where practical.

Example:

Legal Team
      ↓
Contract Repository Access

rather than individual unmanaged permissions.

20. Access Approval

Control example:

Access to Confidential and Restricted information requires approval from the applicable data owner or authorized delegate.

21. Access Evidence

Examples:

Access Request

Approval

Assigned Role

Data Owner

Provisioning Record

22. Access Reviews

Periodic reviews should identify:

Excessive Access

Former Employees

Role Changes

Dormant Accounts

Unauthorized External Users

23. Access Review Control

Access to Confidential and Restricted information repositories is reviewed periodically by authorized data owners.

24. Privileged Access

Administrators may have broad technical access to confidential information.

Controls may include:

MFA

PAM

Logging

Just-in-Time Access

Periodic Review

25. Privileged Access Risk

Example:

Database Administrator
      ↓
Can Access Customer Data

Even if the business application restricts normal users, privileged infrastructure access must also be considered.

26. Service Accounts

Applications may access confidential information.

Therefore review:

Service Account

API Identity

Permissions

Credential Protection

Ownership

27. Data Access Logging

Sensitive repositories should log important access where appropriate.

Examples:

File Downloads

Database Queries

Administrative Access

Sharing Changes

28. Encryption at Rest

Confidential information may require encryption while stored.

Examples:

Database Encryption

Disk Encryption

Object Storage Encryption

Backup Encryption

29. Encryption Control

Confidential and Restricted information stored in approved systems is encrypted at rest using approved cryptographic mechanisms.

30. Encryption Evidence

Examples:

Storage Configuration

Database Configuration

Key Settings

Encryption Coverage Report

31. Encryption in Transit

Confidential information should be protected when transmitted.

Examples:

HTTPS

TLS

VPN

Secure File Transfer

32. Weak Transport

Avoid:

HTTP

Plain FTP

Unencrypted Administrative Protocol

for confidential information.

33. Transport Encryption Control

Confidential information transmitted across untrusted networks is protected using approved encrypted communication protocols.

34. Key Management

Encryption is only as strong as its key management.

Controls should address:

Key Creation

Storage

Access

Rotation

Revocation

Deletion

35. Who Can Access Keys?

Ask:

Who administers keys?

Who can use keys?

Who can decrypt data?

Who reviews access?

36. Key Segregation

A strong design may separate:

Data Administration

from:

Key Administration

where appropriate.

37. Customer-Managed Keys

Some organizations may require:

Customer-Managed Encryption Keys

for high-sensitivity information.

This can provide stronger control but adds operational responsibility.

38. Key Rotation

Example control:

Cryptographic keys protecting Confidential and Restricted information are rotated according to defined security requirements.

39. Key Access Evidence

Examples:

Key IAM Policy

Administrator List

Usage Logs

Access Review

40. Secrets Management

Secrets may include:

Passwords

API Keys

Tokens

Private Keys

Database Credentials

These should be treated as highly sensitive.

41. Secrets Storage

Avoid:

Source Code

Spreadsheets

Email

Plaintext Files

Use approved secret-management mechanisms.

42. Source Code Confidentiality

Source code can be highly valuable confidential information.

Controls may include:

Repository Access

Branch Protection

MFA

Logging

External Collaborator Review

43. Repository Access Review

Review:

Employees

Contractors

External Developers

Service Accounts

44. Data Sharing

Confidential information often needs to be shared.

The process should control:

Recipient

Purpose

Method

Approval

Duration

45. Internal Sharing

Example:

Confidential Contract
      ↓
Legal + Finance

Avoid unnecessary organization-wide access.

46. External Sharing

Before sending confidential information outside the organization, consider:

Recipient Authorization

Contractual Protection

Secure Transfer

Data Minimization

47. External Sharing Control

Confidential information may be shared externally only with authorized recipients using approved secure-transfer mechanisms and required contractual protections.

48. Sharing Register

Create:

03 Confidential Data Sharing Register

Use:

Data	Recipient	Purpose	Method	Approval	Expiry

49. Public Links

SaaS platforms may allow:

Anyone With Link

sharing.

This creates confidentiality risk.

Monitor:

Public Links

Anonymous Sharing

Guest Accounts

50. External Collaborators

Review:

Business Need

Sponsor

Access Level

Expiry

51. Data Loss Prevention

DLP may help detect:

Sensitive Email Attachment

Confidential Upload

Unauthorized USB Copy

External File Sharing

DLP is one potential detective control.

52. DLP Does Not Replace Governance

A DLP product alone does not define:

What is confidential?

Who may share it?

With whom?

Under what conditions?

Policies and ownership remain necessary.

53. Third-Party Confidentiality

Vendors may process confidential information.

The organization should understand:

What Data?

Why?

Where?

Who Accesses It?

What Controls?

54. Vendor Risk Assessment

For providers handling confidential data assess:

SOC 2

ISO 27001

Encryption

Access Controls

Incident Response

Subprocessors

Deletion

55. Contractual Confidentiality

Contracts may include:

Confidentiality Clause

Security Requirements

Use Restrictions

Incident Notification

Return / Deletion

56. Minimum Necessary Data

Do not provide a vendor with:

Entire Customer Database

when it only requires:

Customer ID
+
Email

Data minimization reduces confidentiality exposure.

57. Subprocessors

A provider may share information with:

Cloud Provider

Support Provider

Analytics Provider

Subprocessor

These dependencies should be known.

58. Third-Party Sharing Map

Conceptually:

Organization
      ↓
SaaS Provider
      ↓
Cloud Provider
      ↓
Support Provider

Confidentiality obligations should follow the data.

59. Cloud Confidentiality

Cloud controls may include:

Approved Regions

Encryption

IAM

Private Networking

Logging

Provider Assurance

60. SaaS Confidentiality

For SaaS platforms review:

Admin Access

External Sharing

Encryption

Data Export

Logs

Retention

Deletion

61. Endpoint Confidentiality

Confidential data may reach employee endpoints.

Controls may include:

Disk Encryption

Screen Lock

EDR

USB Restrictions

Remote Wipe

62. Mobile Devices

If confidential data is accessible from mobile devices, consider:

MDM

Encryption

Device Lock

Remote Wipe

Application Controls

63. Printing

Confidentiality applies to physical copies too.

Controls may include:

Secure Printing

Restricted Areas

Shredding

Clean Desk

64. Email

Email is a common confidentiality channel.

Risks include:

Wrong Recipient

Forwarding

Personal Email

Unencrypted Attachment

65. Secure Messaging

For highly sensitive information, organizations may use:

Secure Portal

Encrypted Messaging

Approved File Transfer

instead of normal email.

66. Confidentiality and Retention

Keeping confidential information longer than required increases exposure.

Therefore define:

Retention Period

Retention Reason

Deletion Trigger

Owner

67. Retention Requirements

Requirements may come from:

Business Need

Contract

Law

Policy

Litigation Hold

68. Retention Schedule

Example:

Data	Retention
Customer Contract	Contract + 7 Years
Security Logs	1 Year
Source Code	Business Need
Temporary Export	30 Days

69. Retention Control

Confidential information is retained according to approved business, legal, contractual, and security requirements.

70. Retention Evidence

Examples:

Retention Policy

System Configuration

Deletion Job

Retention Report

71. Legal Holds

Normal deletion may be suspended because of:

Litigation

Investigation

Regulatory Hold

Legal-hold requirements should be governed.

72. Secure Disposal

At the end of retention:

Confidential Data
      ↓
Secure Disposal

73. Digital Disposal

Possible methods include:

Logical Deletion

Cryptographic Erasure

Secure Media Erasure

based on technology and requirements.

74. Physical Disposal

Examples:

Shredding

Media Destruction

Certified Disposal

75. Disposal Control

Confidential information and associated media are securely disposed of when retention requirements expire and no authorized hold applies.

76. Disposal Evidence

Examples:

Deletion Logs

Destruction Certificates

Ticket

System Record

77. Cloud Data Deletion

Cloud environments complicate deletion.

Copies may exist in:

Primary Storage

Replication

Backups

Logs

Archives

Deletion procedures should account for the service architecture.

78. SaaS Offboarding

When terminating a SaaS provider:

Export Required Data

Revoke Access

Remove Integrations

Request Deletion

Confirm Deletion

79. Provider Deletion Confirmation

Evidence may include:

Deletion Certificate

Provider Confirmation

Contract Closure

80. Confidentiality Incident

Examples include:

Email Sent to Wrong Recipient

Public Storage Exposure

Lost Laptop

Unauthorized Download

Vendor Disclosure

81. Incident Response

Confidentiality incidents should be handled through the security incident process.

Detect
      ↓
Contain
      ↓
Identify Data
      ↓
Assess Exposure
      ↓
Notify
      ↓
Remediate

82. Exposure Assessment

Ask:

What data?

Which classification?

How many records?

Who received it?

Was encryption present?

Was data accessed?

83. Confidentiality Monitoring

Useful signals include:

Bulk Downloads

External Sharing

Public Links

Unusual Database Access

DLP Alerts

Privilege Changes

84. Monitoring Control

Security monitoring mechanisms identify and investigate material events involving unauthorized access to or disclosure of confidential information.

85. Confidentiality Evidence

Examples:

Data Inventory

Access Reports

Encryption Reports

DLP Alerts

Sharing Logs

Retention Evidence

Deletion Evidence

86. Build Confidentiality Control Matrix

Create:

04 Confidentiality Control Matrix

Use:

Control ID	Risk	Control	Owner	Evidence

87. Example Confidentiality Controls

CONF-001
Information Classification

CONF-002
Confidential Data Inventory

CONF-003
Confidential Data Access

CONF-004
Access Review

CONF-005
Encryption at Rest

CONF-006
Encryption in Transit

CONF-007
Key Management

CONF-008
External Sharing

CONF-009
Third-Party Confidentiality

CONF-010
Retention

CONF-011
Secure Disposal

CONF-012
Confidential Data Monitoring

88. CONF-001 — Information Classification

Information is classified according to sensitivity, business impact, contractual obligations, and applicable requirements.

89. CONF-002 — Data Inventory

Confidential and Restricted information repositories are identified and maintained in an approved data inventory.

90. CONF-003 — Confidential Access

Access to Confidential and Restricted information is restricted according to need-to-know and least-privilege principles.

91. CONF-004 — Access Review

Access to critical confidential-information repositories is periodically reviewed by authorized data owners.

92. CONF-005 — Encryption at Rest

Confidential and Restricted information stored in approved systems is encrypted at rest using approved cryptographic mechanisms.

93. CONF-006 — Encryption in Transit

Confidential information transmitted across untrusted networks uses approved encryption protocols.

94. CONF-007 — Key Management

Cryptographic keys protecting Confidential and Restricted information are securely generated, stored, accessed, rotated, and retired according to approved standards.

95. CONF-008 — External Sharing

External disclosure of Confidential information requires authorized business need, approved sharing mechanisms, and appropriate protection.

96. CONF-009 — Third-Party Confidentiality

Third parties receiving Confidential information are subject to risk-based security review and contractual confidentiality obligations.

97. CONF-010 — Retention

Confidential information is retained only for approved business, legal, regulatory, or contractual periods.

98. CONF-011 — Secure Disposal

Confidential information is securely deleted or destroyed when retention requirements expire.

99. CONF-012 — Monitoring

Material access, sharing, and security events involving Confidential information are logged and monitored according to risk.

100. Encryption Evidence Register

Create:

05 Encryption Evidence Register

Use:

System	Data	At Rest	In Transit	Key Model	Status

101. Confidential Sharing Register

Create:

06 Confidential Data Sharing Register

Use:

Data	Recipient	Internal/External	Approval	Method	Status

102. Retention & Disposal Register

Create:

07 Retention & Disposal Register

Use:

Data	Retention	Trigger	Disposal Method	Owner

103. Confidentiality Evidence Matrix

Create:

08 Confidentiality Evidence Matrix

Use:

Control	Evidence	Source	Frequency	Owner

104. Evidence — Classification

Examples:

Classification Policy

Classification Register

Data Labels

105. Evidence — Access

Examples:

Access Population

Approvals

Access Reviews

Permission Reports

106. Evidence — Encryption

Examples:

Encryption Configuration

TLS Configuration

Key Policy

Encryption Coverage

107. Evidence — Sharing

Examples:

Sharing Logs

Approval Records

External User Report

DLP Alerts

108. Evidence — Third Parties

Examples:

Vendor Risk Assessment

SOC 2

Contract

DPA

Subprocessor Review

109. Evidence — Retention

Examples:

Retention Schedule

System Settings

Deletion Logs

110. Confidentiality Control Testing

For each control define:

Requirement

Population

Sample

Evidence

Test

Exceptions

Conclusion

111. Test Classification

Select confidential datasets.

Verify:

Classification Assigned

Owner Assigned

Handling Requirement Defined

112. Test Data Inventory

Compare:

Known Confidential Repositories

against:

Asset / Cloud / SaaS Discovery

Identify missing systems.

113. Test Access

For selected repositories:

Identify Users

Review Business Need

Review Approval

Verify Least Privilege

114. Test Access Reviews

Select review periods.

Verify:

Complete Population

Data Owner Review

Decisions

Removed Access

115. Test Encryption at Rest

Population:

Confidential Data Stores

Verify:

Encryption Enabled

Approved Method

Exception?

116. Test Encryption in Transit

Review:

Web Traffic

APIs

File Transfers

Administrative Connections

Verify approved encrypted protocols.

117. Test Key Management

Sample:

Encryption Keys

Verify:

Owner

Access

Rotation

Logging

118. Test External Sharing

Sample externally shared confidential information.

Verify:

Business Need

Approval

Recipient

Secure Method

119. Test Vendor Confidentiality

For providers receiving confidential information verify:

Risk Assessment

Contract

Security Assurance

Current Need

120. Test Retention

Sample confidential datasets.

Compare:

Retention Policy
vs
Actual Configuration

121. Test Disposal

Select completed deletion events.

Verify:

Request

Approval

Deletion

Evidence

122. Test Confidentiality Monitoring

Sample:

DLP Alerts

Bulk Downloads

Public Sharing Events

Trace:

Detection
      ↓
Investigation
      ↓
Closure

123. Design Effectiveness

Ask:

If this confidentiality control operates as designed, will it reasonably protect the information from unauthorized disclosure?

Example:

Risk:

Source Code Exposure

Control:

Employees are asked not to share code.

This may be insufficient.

A stronger design:

Restricted Repository Access
+
MFA
+
Logging
+
External Sharing Controls

124. Operating Effectiveness

Example:

Control:

Quarterly Confidential Repository Access Review

Expected:

4 Reviews

Actual:

Q1 ✓
Q2 ✓
Q3 ✗
Q4 ✓

Result:

Partially Effective

125. Complete Population Testing

Automated tools may enable testing:

100% Encryption Coverage

100% Public Sharing

100% Repository Access

100% External Guests

126. Sampling Manual Controls

Manual controls may include:

Data Classification

External Sharing Approvals

Vendor Reviews

Deletion Approvals

127. Confidentiality Finding — Access

Five former contractors retained access to a Confidential source-code repository beyond their approved engagement period.

Risk:

Unauthorized Disclosure

Source Code Theft

128. Confidentiality Finding — Encryption

Two production data stores containing Confidential customer information were not encrypted according to the Data Protection Standard.

129. Confidentiality Finding — Sharing

Four Confidential documents were accessible through anonymous public-sharing links without approved exceptions.

130. Confidentiality Finding — Retention

Customer exports containing Confidential information remained in temporary cloud storage beyond the approved 30-day retention period.

131. Confidentiality Finding — Vendor

A third-party analytics provider receives Confidential customer information but has not undergone the required annual security reassessment.

132. Root Cause Analysis — Public Sharing

Example:

Public Link Created
      ↓
Platform Allows Anonymous Sharing
      ↓
Default Setting Enabled
      ↓
No Enterprise Sharing Baseline

Root cause:

The collaboration platform does not enforce an enterprise baseline restricting anonymous external sharing.

133. Correction

Disable Existing Public Links

134. Corrective Action

Disable Anonymous Sharing by Default
      +
Require Approved Exception
      +
Monitor Public Links

135. Confidentiality Exceptions

Example requirement:

Restricted Data
→ Customer-Managed Encryption Key

Legacy SaaS:

Only Provider-Managed Encryption

Exception should include:

Risk

Business Need

Alternative Controls

Approval

Expiry

Migration Plan

136. Confidentiality Dashboard

Useful metrics include:

Confidential Data Inventory Coverage

Encryption Coverage

Confidential Access Review Completion

Public Sharing Links

Open DLP Incidents

Third-Party Assessment Coverage

Overdue Data Deletion

137. Example Dashboard

Metric	Target	Current
Confidential Data Inventory	100%	97%
Encryption Coverage	100%	99%
Access Review Completion	100%	96%
Unauthorized Public Links	0	3
Current Critical Vendor Reviews	100%	94%

138. Confidentiality KPI

Example:

KPI:
Percentage of Confidential data stores
meeting required protection controls

139. Confidentiality KRI

Example:

KRI:
Number of unauthorized public-sharing events
involving Confidential information

Tolerance:

0

140. Encryption KRI

Example:

Confidential data stores
without approved encryption

Tolerance:

0

141. Retention KRI

Example:

Confidential datasets
past approved deletion date

142. Audit Walkthrough — Data Classification

Auditor selects:

Customer Contract Repository

Trace:

Owner
      ↓
Classification
      ↓
Access
      ↓
Encryption
      ↓
Retention

143. Audit Walkthrough — Confidential Access

Auditor selects:

Source Code Repository

Verify:

Authorized Users

MFA

Role

Latest Access Review

External Users

144. Audit Walkthrough — Encryption

Auditor selects:

Customer Database

Review:

Data Classification

Encryption Configuration

Key Model

Key Access

145. Audit Walkthrough — External Sharing

Auditor selects:

Confidential Document Shared With Vendor

Review:

Purpose

Approval

Recipient

Secure Transfer

Contract

146. Audit Walkthrough — Retention

Auditor selects:

Expired Customer Export

Verify:

Retention Requirement

Deletion Trigger

Deletion Evidence

147. Common Confidentiality Mistakes

Mistake 1 — Everything Classified Confidential

Classification loses value.

Mistake 2 — Confidentiality Equals Encryption

Access, sharing, retention, and disposal are ignored.

Mistake 3 — Data Inventory Incomplete

Unknown repositories remain unprotected.

Mistake 4 — Business Users Have Excessive Access

Need-to-know is not enforced.

Mistake 5 — Administrators Ignored

Technical privileged access remains unrestricted.

Mistake 6 — Encryption Enabled but Keys Poorly Protected

Cryptographic control is weakened.

Mistake 7 — Public Sharing Not Monitored

SaaS creates hidden disclosure risk.

Mistake 8 — Vendors Receive More Data Than Necessary

Third-party exposure increases.

Mistake 9 — Retention Defined but Not Enforced

Confidential information remains indefinitely.

Mistake 10 — Deletion Means Primary Database Only

Backups and replicas are ignored.

148. Weak Confidentiality Model

Sensitive Data
      ↓
Encryption Enabled
      ↓
Assume Protected

149. Strong Confidentiality Model

Identify
      ↓
Classify
      ↓
Assign Owner
      ↓
Restrict Access
      ↓
Encrypt
      ↓
Monitor
      ↓
Control Sharing
      ↓
Govern Third Parties
      ↓
Retain
      ↓
Securely Dispose
      ↓
Evidence

150. Practical Activity — Build Confidentiality Control Matrix

Create:

01 Confidentiality Control Matrix

Include at least 15 controls across:

Classification

Inventory

IAM

Encryption

Key Management

Sharing

Third Parties

Retention

Disposal

Monitoring

151. Practical Activity — Build Data Classification Register

Create:

02 Data Classification Register

Add at least 15 fictional data assets.

Use:

Data Asset	Owner	Classification	Handling Requirement

152. Practical Activity — Build Confidential Data Inventory

Create:

03 Confidential Data Inventory

Include:

Database

Cloud Storage

SaaS

Source Repository

Email

Backup

153. Practical Activity — Build Encryption Evidence Register

Create:

04 Encryption Evidence Register

Use:

System	Data	At Rest	In Transit	Key Owner	Status

154. Practical Activity — Build Confidential Sharing Register

Create:

05 Confidential Data Sharing Register

Add internal and external sharing examples.

Track:

Recipient

Purpose

Approval

Method

Expiry

155. Practical Activity — Build Retention & Disposal Register

Create:

06 Retention & Disposal Register

Include at least ten data categories.

156. Practical Activity — Build Confidentiality Evidence Matrix

Create:

07 Confidentiality Evidence Matrix

Map evidence for:

Classification

Access

Encryption

Key Management

Sharing

Vendor Risk

Retention

Deletion

157. Practical Activity — Build Confidentiality Control Testing Checklist

Create:

08 Confidentiality Control Testing Checklist

Test:

Classification

Data Inventory

Confidential Access

Access Review

Encryption at Rest

Encryption in Transit

Key Access

External Sharing

Vendor Confidentiality

Retention

Secure Disposal

Monitoring

158. Confidentiality Readiness Checklist

Governance

• Classification policy established.

• Confidentiality responsibilities defined.

• Data owners assigned.

• Handling requirements documented.

Inventory

• Confidential data identified.

• Systems documented.

• SaaS included.

• Backups included.

• Third parties included.

Access

• Need-to-know implemented.

• Least privilege implemented.

• Access requires approval.

• Privileged access governed.

• Access reviews performed.

• External users reviewed.

Encryption

• Encryption requirements defined.

• Data at rest encrypted.

• Data in transit encrypted.

• Key ownership defined.

• Key access restricted.

• Rotation requirements defined.

Sharing

• Internal sharing controlled.

• External sharing controlled.

• Public links governed.

• Secure transfer methods defined.

• Sharing evidence available.

Third Parties

• Providers identified.

• Vendor assessments performed.

• Confidentiality clauses established.

• Subprocessors considered.

• Data minimization applied.

Retention

• Retention schedules defined.

• System settings aligned.

• Legal holds supported.

• Expired data identified.

Disposal

• Deletion procedures defined.

• Physical media disposal defined.

• SaaS deletion addressed.

• Cloud backups considered.

• Evidence retained.

Monitoring

• Sensitive access logged.

• External sharing monitored.

• DLP used where appropriate.

• Incidents investigated.

• Confidentiality metrics reported.

159. GRC Analyst Responsibilities

A GRC professional supporting SOC 2 Confidentiality may:

• Maintain classification policies.

• Maintain confidential-data inventories.

• Coordinate data ownership.

• Map confidentiality risks to controls.

• Review access-control evidence.

• Review encryption evidence.

• Review key-management controls.

• Review external data-sharing processes.

• Assess third-party confidentiality.

• Review retention requirements.

• Review disposal evidence.

• Test confidentiality controls.

• Document exceptions.

• Facilitate root-cause analysis.

• Track remediation.

• Maintain confidentiality dashboards.

• Support external SOC auditors.

GRC connects:

Data Owners

Security

IAM

Cloud

Engineering

Legal

Procurement

Privacy

Vendors

Auditors

160. Confidentiality Maturity Model

Level 1 — Informal

Sensitive Data Exists
but is not consistently classified.

Level 2 — Defined

Classification

Access

Encryption

Level 3 — Governed

Inventory

Owners

Sharing

Retention

Vendor Controls

Level 4 — Integrated

Automated Classification

DLP

Continuous Access Monitoring

Evidence

Level 5 — Continuous Confidentiality Assurance

Data Discovery

Dynamic Classification

Continuous Sharing Monitoring

Automated Retention

Continuous Control Testing

161. Confidentiality Mindset

For every confidential information asset ask:

What information is this?

Why is it confidential?

Who owns it?

Where is it stored?

Who can access it?

Who has privileged access?

Is access still required?

Is it encrypted?

Who controls the keys?

How is it transmitted?

Can users share it externally?

Which third parties receive it?

How long should it be retained?

How is it deleted?

What happens to backups?

Are material access and sharing events monitored?

What evidence proves each control?

If these questions can be answered, Confidentiality becomes a practical lifecycle rather than simply an encryption requirement.

Key Takeaways

• Confidentiality protects information designated as confidential from unauthorized disclosure.

• Confidentiality and Privacy are related but distinct.

• Data classification provides the foundation for proportionate protection.

• Organizations should know where confidential information is stored and processed.

• Data owners should help define classification, access, sharing, and retention requirements.

• Need-to-know and least privilege are important confidentiality principles.

• Privileged and service-account access should be included in confidentiality governance.

• Encryption should protect confidential information at rest and in transit where required.

• Key management is essential to effective cryptographic protection.

• Secure sharing requires authorized recipients, valid purpose, approved methods, and appropriate controls.

• Third parties and subprocessors can extend the confidentiality boundary.

• Retention should limit how long confidential information remains exposed.

• Secure disposal should include cloud copies, backups, SaaS, and physical media where relevant.

• Monitoring can detect bulk access, public sharing, DLP events, and other disclosure risks.

• SOC 2 confidentiality assurance requires controls, evidence, testing, findings, and remediation across the information lifecycle.

Knowledge Check

Before continuing, make sure you can answer:

1. What does the SOC 2 Confidentiality category address?

2. How does Confidentiality differ from Security?

3. How does Confidentiality differ from Privacy?

4. Why is information classification important?

5. What should a confidential-data inventory contain?

6. What is the need-to-know principle?

7. Why should privileged access be included?

8. Why are service accounts relevant?

9. What does encryption at rest protect?

10. Why is encryption in transit important?

11. Why is key management critical?

12. What risks exist with external sharing?

13. How can DLP support confidentiality?

14. Why should third parties be included?

15. What is data minimization?

16. Why should retention be controlled?

17. What should secure disposal address?

18. Why are cloud backups relevant to deletion?

19. What evidence can support Confidentiality controls?

20. What role does GRC play in SOC 2 Confidentiality?

What’s Next?

➡️ Next: 09 — Privacy

In the next lesson, you will move from protecting information designated as confidential into governing personal information throughout its complete lifecycle.

You will work through:

Privacy Governance
      ↓
Privacy Notice
      ↓
Collection
      ↓
Choice & Consent
      ↓
Purpose Limitation
      ↓
Use
      ↓
Data Minimization
      ↓
Access & Individual Rights
      ↓
Disclosure
      ↓
Retention
      ↓
Deletion
      ↓
Privacy Incidents
      ↓
Monitoring & Evidence

You will also build practical SOC 2 artifacts including a Privacy Control Matrix, PII Inventory, Processing Purpose Register, Consent Register, Data Subject Request Register, Third-Party PII Sharing Register, Privacy Retention Register, and Privacy Control Testing Checklist.