Which control is described as addressing only incidents that relate to PII?

• A. SE-2 Privacy Incident Response
• B. AR-2 Privacy Impact and Risk Assessment
• C. DI-1 Data Quality
• D. DM-2 Data Retentions and Disposal

Answer: (A)

The main idea is about focusing on handling incidents that involve personal data. PII stands for Personal Identifiable Information, and a privacy incident is an event where such information is exposed, compromised, or at risk. The Privacy Incident Response control is specifically designed to manage those privacy incidents—it's scoped to incidents that relate to PII and governs how they’re detected, analyzed, contained, and remediated.

The other controls cover broader or different areas: Privacy Impact and Risk Assessment deals with identifying and evaluating privacy risks in general, not just incidents; Data Quality focuses on the accuracy and reliability of data; and Data Retentions and Disposal governs how long data is kept and how it is destroyed. None of these are limited to responding to privacy incidents involving PII, so the one that matches the description is the Privacy Incident Response control.