What topic does NIST SP 800-12 address?

• A. Protecting the confidentiality of PII using a risk-based approach
• B. Encryption Key Management
• C. Incident Response Planning
• D. Physical Security of Data Centers

Answer: (A)

NIST SP 800-12 provides an introduction to computer security and emphasizes a risk-based approach to protecting information. It lays out the fundamentals of building and running a security program, guiding how to assess threats, vulnerabilities, and impacts, and then select appropriate safeguards to protect information. Because of this, protecting the confidentiality of data such as PII using a risk-based method is exactly what this publication centers on. Other topics like encryption key management, incident response planning, or physical security are important but are covered more specifically in other NIST guides; 800-12 focuses on the broader security program and the risk-based approach to safeguarding information.