An assessor emails a spreadsheet labeled Confidential—containing taxpayer identifiers—unencrypted to a personal Gmail account for weekend work. What does this primarily violate?
Select an answer to reveal the explanation.
Short Explanation
Confidential stamped on the file is a stop sign for "email it naked to your weekend inbox." Personal webmail skips the city's encryption, logging, and retention controls. Transmission handling means the path matches the label—approved channels, protected in transit—not convenience routing.
Full Explanation
Emailing a Confidential spreadsheet of taxpayer identifiers unencrypted to a personal Gmail account primarily violates secure transmission and handling requirements based on the data's classification. Confidential markings dictate approved channels, protection in transit, logging, and retention—personal consumer webmail bypasses city encryption, DLP, and records controls. Transmission handling means the path matches the label, not weekend convenience.
Treating this as only a physical USB labeling issue fails by concept: email is a transmission path, and classification-driven handling applies to electronic transfer as well as media. Framing it as a CMDB filename inventory rule fails because configuration-item naming is not the control violated by off-network Confidential email. Citing end-of-support policy for citizen webmail providers fails as a category error—the violation is staff misuse of personal mail for city Confidential data, not citizen browser choice.
Exam caveat: CISSP expects classification to govern transmission; sending Confidential data to personal accounts is a canonical handling failure. Operational check: block or alert on Confidential-tagged files to personal domains, provide approved remote-access paths for weekend work, and discipline clear policy breaches involving taxpayer identifiers.