Governance, Risk, Compliance, Privacy and Ethics

Introduction

Network security is no longer exclusively a technical function. Firewalls, identity systems, encryption, endpoint controls and monitoring are effective only when an organisation has defined responsibilities, accepted risk deliberately, complied with applicable obligations and behaved ethically toward employees, customers and society. Governance provides direction and accountability; risk management supports informed decisions under uncertainty; compliance demonstrates conformity with laws, regulations, contracts and internal requirements; privacy protects people and their information; and ethics guides conduct where legal rules are incomplete or conflicting.

For postgraduate IT engineers, these subjects must be understood as an integrated system. A security architect may design a technically strong control that violates privacy principles. A risk manager may identify a severe exposure but lack authority to obtain funding. A compliance team may collect evidence of control operation without determining whether the control actually reduces risk. Effective security therefore connects organisational strategy, engineering practice, assurance and public responsibility.

This chapter examines five major governance and assurance frameworks: the NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), ISO/IEC 27001 and the CIS Critical Security Controls. It also explains risk assessment, third-party governance, privacy, ethics, policy, accountability, audit assurance and contemporary issues such as artificial intelligence.

Learning Objectives

After studying this chapter, a student should be able to:

1. Distinguish governance, risk, compliance, privacy and ethics.

2. Apply the NIST CSF, NIST RMF, ISO/IEC 27001 and CIS Controls appropriately.

3. Conduct a qualitative and quantitative information-security risk assessment.

4. Design third-party security governance and assurance activities.

5. Relate privacy principles and regulatory obligations to security engineering.

6. Establish policies, roles, accountability and audit evidence.

7. Critically evaluate limitations, conflicts and ethical consequences of security decisions.

1. Governance as the Direction of Security

Governance is the system by which an organisation is directed, controlled and held accountable. Security governance determines objectives, authority, risk appetite, resource allocation, oversight and reporting. It is distinct from management. The governing body approves strategy and monitors performance, whereas management plans and operates programmes within that direction.

A mature governance model answers five questions:

• What outcomes must security support?
• Which risks are acceptable, transferable or unacceptable?
• Who has authority to make decisions and accept residual risk?
• How will performance and control effectiveness be measured?
• How will failures be reported, investigated and corrected?

Security governance should be integrated with enterprise governance rather than isolated in an information-technology department. For example, a decision to place customer data in a cloud service affects legal exposure, business continuity, procurement, finance, privacy and reputation in addition to infrastructure security.

Accountability and the three lines model

A useful accountability pattern is the three lines model. The first line consists of business and technology owners who operate processes and controls. The second line includes risk, compliance, privacy and security functions that advise, challenge and monitor. The third line is internal audit, which provides independent assurance to the governing body. External auditors, regulators and certification bodies provide additional external assurance but do not replace management accountability.

Important roles include the information or system owner, data owner, risk owner, chief information security officer, privacy officer, control operator and auditor. Responsibility should be documented in a RACI matrix: responsible persons perform work, accountable persons own the outcome, consulted parties provide expertise and informed parties receive information. One individual may perform more than one role in a small organisation, but incompatible duties should be separated where practical.

2. Risk Management and Assessment

Risk is the effect of uncertainty on objectives. In information security, risk commonly arises when a threat can exploit a vulnerability and cause harm to an asset, process, person or organisation. Threats include malicious actors, insiders, accidents, natural events and supply-chain failures. Vulnerabilities may be technical, procedural, human or physical.

A risk assessment normally includes:

1. Establishing scope, assumptions, stakeholders and risk criteria.

2. Identifying assets, processes, data and dependencies.

3. Identifying threats and vulnerabilities.

4. Estimating likelihood and impact.

5. Evaluating the result against risk appetite and tolerance.

6. Selecting treatment and recording residual risk.

7. Monitoring changes and reassessing periodically or after major events.

Risk should be expressed in business terms. “An unpatched server exists” is a condition; “a vulnerability could interrupt payment processing and expose regulated data” is a risk statement. A well-formed statement identifies the source, event, vulnerability, consequence and affected objective.

Qualitative analysis

Qualitative methods use categories such as low, moderate and high. A risk matrix may assign likelihood and impact scores from 1 to 5 and multiply them to rank risks. This multiplication is a prioritisation convention, not a law of probability. It assumes that the organisation has defined scales consistently and that the resulting score is useful for comparison. A score must not conceal a catastrophic low-likelihood event or imply false precision.

Quantitative analysis

A basic annualised loss expectancy model is:

SLE = AV × EF

where SLE is single loss expectancy, AV is asset value in monetary units and EF is exposure factor, the proportion of value lost in one occurrence. If an outage affects an asset valued at $200,000 and the estimated exposure factor is 0.30, SLE is $60,000.

If the event is expected to occur 0.5 times per year, the annualised loss expectancy is:

ALE = SLE × ARO

where ARO is annualised rate of occurrence. Thus ALE is $60,000 × 0.5 = $30,000 per year. These estimates are decision aids, not guarantees. They may omit legal penalties, correlated events, uncertainty, intangible harm and the cost of estimation. They are most useful when assumptions and ranges are documented.

A control decision can compare expected loss reduction with total control cost. However, a control should not be rejected solely because its estimated financial return is low when legal, ethical or safety obligations require it. Quantification should support judgement, not replace it.

Treatment and residual risk

Risk treatment options are usually avoid, reduce, share or retain. Avoidance changes the activity; reduction applies controls; sharing may involve insurance or contractual allocation; retention is an informed decision to accept the remaining exposure. Risk transfer does not remove accountability. A cloud contract may allocate some costs but cannot eliminate an organisation’s duties to individuals whose data it processes.

Residual risk is the risk remaining after controls. Acceptance should be explicit, time-bounded where appropriate, assigned to an authorised risk owner and supported by compensating controls or remediation plans. “Accepted” must not mean “ignored.”

3. Major Security Frameworks

3.1 NIST Cybersecurity Framework

The NIST CSF provides a flexible structure for managing cybersecurity risk. Its current core functions are Govern, Identify, Protect, Detect, Respond and Recover. Govern establishes organisational context, risk strategy, roles, policy and oversight. Identify develops understanding of assets, risks and dependencies. Protect implements safeguards. Detect discovers cybersecurity events. Respond contains and manages incidents. Recover restores capabilities and incorporates lessons learned.

The CSF is outcome-oriented rather than a prescriptive checklist. Organisations can create a current profile describing present outcomes, a target profile describing desired outcomes and a gap analysis between them. Tiers describe the sophistication and integration of risk-management practices, from partial and ad hoc practices to adaptive, continuously improving practices. The framework can be used by public agencies, enterprises and small organisations, but its outcomes must be interpreted in context.

3.2 NIST Risk Management Framework

The NIST RMF provides a structured lifecycle for systems, especially in public-sector and high-assurance environments. Its steps are Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor.

Prepare establishes organisational and system context. Categorize determines the potential impact of loss of confidentiality, integrity and availability. Select chooses controls based on categorisation and tailoring. Implement documents and deploys controls. Assess determines whether controls are correctly implemented and effective. Authorize is a senior official’s risk-based decision to operate. Monitor provides continuous oversight of controls, changes, vulnerabilities and risk.

The RMF emphasises that authorisation is an accountable decision, not a technical certificate. Control baselines can be tailored by adding, removing or modifying controls with justification. The RMF is particularly valuable where systems have formal authorising officials, security plans and assessment reports.

3.3 ISO/IEC 27001

ISO/IEC 27001 specifies requirements for an information security management system (ISMS). An ISMS is a management system, not merely a collection of technical controls. It requires organisational context, leadership, planning, support, operation, performance evaluation and improvement. Risk assessment and risk treatment are central. The organisation selects controls appropriate to its risks and documents applicability and justification, commonly through a Statement of Applicability.

Certification is performed by an independent certification body against the standard’s requirements. Certification provides evidence that an ISMS conforms at the time and scope of assessment; it does not guarantee that no breach will occur. Effective organisations use internal audits, management reviews, corrective action and continual improvement rather than treating certification as a one-time achievement.

3.4 CIS Critical Security Controls

The CIS Controls provide prioritised, practical safeguards. They are useful for translating broad governance objectives into operational action, especially for organisations building foundational capability. Examples include maintaining an enterprise asset inventory, managing software assets, applying data protection, securing configurations, managing accounts, managing vulnerabilities, conducting audit-log management, malware defences, recovery and incident response.

Implementation Groups help organisations select safeguards according to resources, risk and threat exposure. The Controls are operationally concrete, but they do not replace legal analysis, enterprise risk governance or a complete ISMS. They can serve as evidence-producing implementation guidance beneath the broader NIST or ISO structure.

Integrating the frameworks

These frameworks are complementary, not mutually exclusive. A practical arrangement is to use ISO/IEC 27001 for management-system governance and certification, NIST CSF for communicating desired cybersecurity outcomes, NIST RMF for system-level lifecycle authorisation and CIS Controls for prioritised technical implementation. A crosswalk can reduce duplicated work, but crosswalks must be validated because similarly named controls may differ in scope, intent or evidence requirements.

4. Compliance, Policy and Audit Assurance

Compliance includes obligations arising from legislation, regulation, contracts, standards and internal policy. It is broader than passing an audit. Compliance asks whether requirements are met; security governance asks whether risks are controlled; assurance asks whether decision-makers can rely on evidence.

A policy states management intent and mandatory direction. Standards define mandatory specifications, procedures describe repeatable steps, and guidelines provide recommended practice. A policy library should have an owner, approval authority, version control, review date, exception process and communication plan. Policies should be concise enough to be understood and specific enough to be enforceable.

Good audit evidence is relevant, reliable, complete, timely and attributable. Examples include access-review records, configuration baselines, vulnerability-remediation tickets, incident reports, training records, supplier assessments and meeting minutes showing risk acceptance. A screenshot without system context or time may be weak evidence. Automated evidence can improve consistency, but it must be protected against manipulation and interpreted by knowledgeable reviewers.

Control design asks whether a control, if operated as intended, could address the risk. Operating effectiveness asks whether it actually operated consistently during the relevant period. A control may be well designed but ineffective in practice, or operational but poorly designed. Audit findings should identify condition, criterion, cause, consequence and agreed corrective action.

5. Third-Party and Supply-Chain Governance

Organisations depend on cloud providers, software vendors, managed-service providers, contractors, open-source components and hardware manufacturers. Third-party risk is not eliminated by outsourcing; responsibility and visibility may become more difficult.

A supplier lifecycle includes classification, due diligence, contracting, onboarding, continuous monitoring, incident coordination and exit. Risk classification may consider data sensitivity, system criticality, privileged access, geographical processing, concentration risk, subcontractors and recovery dependence. Due diligence can include security questionnaires, independent assurance reports, penetration-test summaries, architecture reviews and reference checks. Evidence should be proportionate: a low-risk stationery supplier does not require the same scrutiny as a provider hosting health records.

Contracts should address security requirements, confidentiality, data ownership, permitted processing, access control, encryption expectations, vulnerability disclosure, incident notification, audit or assurance rights, subcontracting, business continuity, retention, deletion and return of data, legal requests and termination assistance. Service-level agreements should define measurable obligations rather than general promises.

Continuous monitoring may use changes in assurance reports, vulnerability intelligence, incidents, service performance, access reviews and material changes in ownership or architecture. Organisations should test whether a provider’s recovery claims align with their own recovery objectives. Exit planning is essential because portability barriers and concentration can turn a supplier outage into an enterprise crisis.

6. Privacy and Data Governance

Privacy concerns how information about identified or identifiable people is collected, used, disclosed, retained and deleted. Security protects confidentiality, integrity and availability, but privacy additionally addresses purpose, fairness, transparency, autonomy and rights. Strong security is necessary for privacy but is not sufficient.

Common privacy principles include lawfulness and fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality and accountability. Terminology and specific duties vary among jurisdictions. A controller or business commonly determines purposes and means of processing, while a processor or service provider processes information on behalf of another organisation; legal definitions must be checked in the applicable jurisdiction.

Privacy by design means considering privacy throughout requirements, architecture, development, procurement, deployment and retirement. Practical measures include collecting only necessary fields, separating identifiers, applying role-based access, encrypting data in transit and at rest, using retention schedules, testing deletion, logging access, masking data in development and documenting lawful purposes.

A privacy impact assessment is appropriate where processing may create significant risks, such as large-scale monitoring, biometrics, profiling, sensitive data, location tracking or novel artificial-intelligence systems. It should describe processing, necessity, proportionality, risks to individuals, safeguards, residual risk and consultation. Data-subject rights and breach-notification duties vary by law; organisations must maintain a jurisdiction-specific obligations register rather than assume that one privacy regime applies universally.

Security monitoring also creates privacy risk. Excessive employee surveillance, indefinite retention of communications or indiscriminate collection of browsing data may be technically possible but disproportionate. Access to security data should itself be controlled, logged and limited to legitimate purposes.

7. Ethics in Network Security

Law establishes minimum enforceable requirements; ethics asks what ought to be done. Ethical security practice respects human dignity, autonomy, fairness, non-maleficence, beneficence, accountability and professional competence.

Examples of ethical tensions include whether to deploy intrusive monitoring, whether to disclose a vulnerability before remediation is possible, whether to use deception in a honeypot, whether to scan systems owned by another party, and whether an algorithmic detection system unfairly targets a group. Authorisation, necessity, proportionality, transparency and harm reduction are useful decision tests.

Security professionals must not access systems without permission, misuse privileged information, conceal material risks or claim assurance beyond available evidence. Responsible vulnerability disclosure normally gives an affected provider an opportunity to investigate and remediate while considering the risk to users and the public. Emergency disclosure may be justified when delay creates serious imminent harm, but such decisions should be documented and reviewed.

Artificial intelligence creates additional governance concerns. Training data may contain personal or copyrighted information; models may leak sensitive content; automated decisions may be biased; generated code may contain vulnerabilities; and opaque outputs may be difficult to audit. Controls should include approved-use policies, data classification, human review for consequential decisions, model and prompt logging where appropriate, security testing, supplier assessment, output validation and clear accountability. AI should support professional judgement rather than become an unreviewable substitute for it.

8. An Integrated Operating Model

A practical operating model connects strategy to evidence:

1. Establish business objectives, legal obligations, risk appetite and stakeholder expectations.

2. Define scope, assets, data flows, dependencies and accountable owners.

3. Perform risk and privacy assessments using documented criteria.

4. Select a framework baseline and map obligations to outcomes and controls.

5. Design policies, standards, procedures and technical safeguards.

6. Implement controls and generate trustworthy evidence.

7. Assess design and operating effectiveness independently where appropriate.

8. Authorise residual risk through the correct governance forum.

9. Monitor threats, control performance, suppliers, regulatory change and business change.

10. Improve through incidents, exercises, audits, metrics and management review.

Useful measures include the percentage of critical assets inventoried, time to remediate high-risk vulnerabilities, privileged-account review completion, tested recovery capability, supplier-assessment coverage and recurrence of audit findings. Metrics should explain risk and support decisions. Counting the number of policies or alerts alone can encourage superficial compliance.

9. Illustrative Case: FinServe Cloud Migration

Background

FinServe, a fictional regional payments company, plans to migrate its customer-support platform to a cloud provider. The platform will contain identity information, transaction queries and recorded customer communications. The provider uses subcontractors for support and operates across several jurisdictions.

Problem

The project team has completed a technical architecture but has not identified a system owner, confirmed data-processing locations, assessed subcontractors or agreed who may accept residual risk. The procurement team proposes relying on the provider’s generic security certification.

Analysis

Using the NIST CSF, the organisation first establishes governance and identifies data, dependencies and critical services. The RMF approach leads to categorisation of confidentiality, integrity and availability impacts, selection of controls, assessment and formal authorisation. An ISO/IEC 27001 ISMS process requires documented risk treatment, supplier controls, internal review and management oversight. CIS Controls guide implementation of asset inventory, identity management, secure configuration, logging, vulnerability management and recovery.

The privacy team performs a privacy impact assessment. It identifies excessive retention of call recordings, uncertain international transfers and the possibility that provider support personnel could access live records. A risk assessment identifies a high-impact scenario in which compromised privileged credentials expose customer records. Quantitative estimates are treated as ranges because breach frequency and consequences are uncertain; the decision is not reduced to a single precise number.

Approach and solution

FinServe appoints a system owner and risk owner, limits the dataset transferred, masks payment details, establishes retention and deletion tests, and separates support access through just-in-time privileged accounts. The contract requires incident notification, approved subcontractors, assurance evidence, cooperation with investigations, deletion on exit, recovery testing and audit rights proportionate to risk. Encryption keys are managed with an arrangement that prevents routine provider personnel from accessing plaintext. Logs are sent to FinServe’s monitoring service, and recovery exercises test restoration into an alternative environment.

The provider’s certification is used as evidence but supplemented by a review of scope, exceptions, control reports and service-specific risks. Senior management authorises operation only after high risks have owners and treatment plans.

Outcome

The migration proceeds with a reduced data set and stronger access governance. A later recovery exercise reveals that one customer-support integration cannot be restored within the required business objective. The issue is recorded before production launch, and the integration is redesigned. This demonstrates why assurance must test actual outcomes rather than rely on certificates or contractual language alone.

Learning points

The case illustrates that cloud security is shared but accountability remains with the organisation. Frameworks are most effective when integrated, privacy analysis must influence architecture, supplier assurance must be continuous, and authorisation is a business decision supported by technical evidence.

10. Challenges and Limitations

Frameworks can create paperwork without reducing risk when organisations pursue compliance certificates as ends in themselves. Control catalogues may become outdated, crosswalks may imply equivalence where none exists, and risk matrices may hide uncertainty. Audits are samples taken at particular times; they cannot prove that every event will be prevented. Quantitative estimates may be unreliable when historical data is sparse. Privacy law differs across jurisdictions and can conflict with operational expectations. Small organisations may lack specialists, while large organisations may suffer from fragmented ownership.

Governance also faces competing incentives. Business units may resist controls that slow delivery. Security teams may over-collect data to improve detection. Regulators may require documentation that does not map neatly to engineering practice. Effective leaders address these tensions through risk-based prioritisation, transparent escalation, proportionate controls, independent challenge and continual learning.

Contemporary Developments and Best Practices

Contemporary governance increasingly emphasises cyber resilience, software supply-chain security, secure-by-design products, zero-trust architectures, cloud concentration risk and algorithmic accountability. Organisations should maintain inventories of systems and data, integrate security into procurement and development, test recovery rather than merely document it, and treat identity as a central control plane.

Best practice includes:

• Aligning security objectives with mission and enterprise risk.
• Assigning named owners for systems, data, risks and controls.
• Using frameworks as adaptable structures, not checklists.
• Maintaining an obligations register for laws, contracts and standards.
• Applying privacy and security requirements at design time.
• Testing suppliers, recovery and incident communication.
• Separating control operation from independent assurance.
• Recording assumptions, exceptions and residual-risk decisions.
• Measuring outcomes and correcting recurring weaknesses.
• Reviewing ethical consequences, especially for surveillance and AI.

Chapter Summary

Security governance directs organisational security through authority, accountability, risk appetite and oversight. Risk assessment identifies threats, vulnerabilities, consequences and treatment options; qualitative scores support prioritisation, while quantitative estimates can inform financial decisions when assumptions are explicit. The NIST CSF organises outcomes through Govern, Identify, Protect, Detect, Respond and Recover. NIST RMF provides a lifecycle of Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. ISO/IEC 27001 establishes an auditable information security management system, while CIS Controls provide prioritised operational safeguards.

Compliance is broader than audit success, and assurance depends on reliable evidence and independent challenge. Third-party governance must continue across the supplier lifecycle. Privacy requires purpose limitation, minimisation, transparency, rights and accountability in addition to security. Ethical practice addresses proportionality, human dignity, authorised access, responsible disclosure and the social effects of monitoring and AI. Mature organisations integrate these disciplines into strategy, engineering, procurement, operations and continual improvement.

Key Terms

Governance: Direction, oversight and accountability through which an organisation is controlled.

Risk appetite: The amount and type of risk an organisation is willing to pursue or retain.

Risk owner: Person authorised to manage and accept a defined risk.

Residual risk: Risk remaining after controls are applied.

Threat: A potential cause of an unwanted event.

Vulnerability: A weakness that may be exploited.

NIST CSF: Outcome-oriented framework for managing cybersecurity risk.

NIST RMF: Lifecycle framework for system security risk management and authorisation.

ISMS: Information security management system.

Statement of Applicability: Document explaining selected, excluded and justified ISO/IEC 27001 controls.

CIS Controls: Prioritised safeguards for improving cybersecurity posture.

Compliance: Conformity with applicable obligations and requirements.

Assurance: Justified confidence in governance, risk and control information.

Privacy by design: Integrating privacy protections throughout system and process lifecycles.

Data minimisation: Collecting and using no more personal data than necessary.

Third-party risk: Risk arising from suppliers, service providers or other external dependencies.

RACI: Matrix identifying responsible, accountable, consulted and informed parties.

Exposure factor: Proportion of asset value estimated to be lost in one event.

Annualised rate of occurrence: Estimated frequency of an event per year.

Responsible disclosure: Coordinated reporting of vulnerabilities to reduce harm.

Review Questions

Short Answer Questions

1. Distinguish governance from security management.

2. What is residual risk, and who should accept it?

3. Name the six current functions of the NIST CSF.

4. Why does ISO/IEC 27001 certification not guarantee that breaches will not occur?

5. Explain why security is necessary but not sufficient for privacy.

Long Answer Questions

1. Compare the purposes and appropriate uses of the NIST CSF, NIST RMF, ISO/IEC 27001 and CIS Controls.

2. Explain the stages of a robust information-security risk assessment and discuss limitations of risk matrices.

3. Design a third-party governance lifecycle for a cloud provider handling sensitive personal data.

4. Discuss how policies, control evidence, internal audit and management review contribute to assurance.

5. Analyse the ethical and governance implications of extensive employee monitoring and AI-assisted security decisions.

Analytical / Application Questions

1. An organisation values a critical service at $500,000, estimates an exposure factor of 0.20 and an annualised rate of occurrence of 0.4. Calculate SLE and ALE, state the assumptions, and explain why the result should not alone determine treatment.

2. A supplier provides an ISO/IEC 27001 certificate but refuses incident-notification commitments and deletion verification. Evaluate whether procurement should proceed and identify compensating actions.

3. A security operations centre wants to retain all employee communications indefinitely to improve threat detection. Apply governance, privacy and ethical principles to recommend a proportionate policy.

Multiple Choice Questions with Answers

Question 1

Which NIST CSF function establishes organisational context, risk strategy, roles and oversight?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 2

Which NIST RMF step involves a senior official’s decision to permit operation based on risk?

A. Categorize

B. Authorize

C. Implement

D. Monitor

Correct Answer: B. Authorize

Question 3

An asset is valued at $200,000 and has an exposure factor of 0.30. What is the single loss expectancy?

A. $30,000

B. $60,000

C. $200,000

D. $666,667

Correct Answer: B. $60,000

Question 4

What is the primary purpose of an ISO/IEC 27001 Statement of Applicability?

A. To list every cyber incident

B. To justify selected and excluded controls

C. To replace risk assessment

D. To certify individual employees

Correct Answer: B. To justify selected and excluded controls

Question 5

Which activity best represents the third line in the three lines model?

A. Operating access controls

B. Advising on compliance

C. Performing independent internal audit

D. Approving a firewall rule

Correct Answer: C. Performing independent internal audit

Question 6

Which principle limits collection of personal information to what is necessary?

A. Data minimisation

B. Availability

C. Non-repudiation

D. Least privilege only

Correct Answer: A. Data minimisation

Question 7

Why is a supplier’s security certification insufficient by itself?

A. Certifications never contain evidence

B. Certification scope and service-specific risks may not match

C. Contracts cannot address security

D. Cloud services cannot be audited

Correct Answer: B. Certification scope and service-specific risks may not match

Question 8

Which statement best describes residual risk?

A. Risk before any controls exist

B. Risk transferred entirely to an insurer

C. Risk remaining after controls are applied

D. Risk that has no identified owner

Correct Answer: C. Risk remaining after controls are applied

Question 9

Which evidence is generally strongest for demonstrating a control operated over a period?

A. An undated marketing slide

B. A single unsupported screenshot

C. Attributable, time-stamped access-review records

D. An informal verbal assurance

Correct Answer: C. Attributable, time-stamped access-review records

Question 10

A system owner wants to use production personal data in development without masking. Which principle is most directly threatened?

A. Purpose limitation and privacy by design

B. Network availability

C. Disaster recovery capacity

D. Physical redundancy

Correct Answer: A. Purpose limitation and privacy by design