Which of the following best describes the required data privacy and information security measures for financial data?

• A. Store passwords in plain text
• B. Disable backups
• C. Implement access controls, encryption, secure backups, and policies for handling sensitive information
• D. Share all financial data with members

Answer: (C)

Protecting financial data relies on layered data privacy and information security measures that control who can access the data, how it’s protected, and how it’s handled. Implementing access controls ensures only authorized individuals can view or modify financial information, reducing the chance of insider or external misuse. Encryption protects data both when it’s stored (at rest) and when it’s transmitted, so even if the data is intercepted or stolen, it remains unreadable. Secure backups preserve data integrity and availability, enabling recovery after accidents, corruption, or ransomware attacks. Clear policies for handling sensitive information provide consistent rules and responsibilities across the organization, guiding behavior, compliance, and auditability.

Storing passwords in plain text creates an easy target for attackers, since credentials would be exposed if the data is breached. Disabling backups leaves the organization vulnerable to data loss and makes recovery difficult after incidents. Sharing all financial data with members violates confidentiality and privacy principles; access should be restricted to those who need to know, with appropriate controls and monitoring.