Security+ 801 Countdown, T-18: Data Roles, Handling, and Life Cycle Move Into Architecture

Every security control that touches data depends on three facts the control itself cannot supply: who is responsible for the data, where the data is allowed to be, and what stage of its life it is in. A backup job needs someone with the authority to set how long copies are kept. An encryption policy needs to know which files are sensitive before it can protect them. A disposal procedure needs to know whether a drive is being reused inside the organization or leaving it. Data governance supplies those facts, and when it is missing, controls get configured on guesses.

SY0-801 objective 3.3 brings this material into the architecture domain with three groups of items that are new to that objective: six data protection roles, five data handling concerns, and a five-stage data management life cycle (CompTIA 2025). The sections below take them in that order: the roles as a chain of accountability that runs from a company down to a cloud subprocessor, handling as the marks, labels, and location boundaries that let software enforce a classification, and the life cycle as the frame that gives every control a stage to belong to. The frame ends at disposal, where NIST revised the governing standard in September 2025.

Six roles on two layers

Four of the six roles describe internal accountability inside one organization; the other two come from privacy law and describe organizations in relation to one another. Mixing the layers is the trap, because a person can hold a role on the first layer while the organization that employs them holds a role on the second.

The data owner is accountable. NIST’s “information owner” holds “responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal” (NIST 2026), which is the whole life cycle in one sentence. The owner classifies, approves access, and accepts risk. The data custodian implements what the owner decides: storage, access configuration, backups, encryption, and logging. The data steward owns meaning and quality; NIST’s glossary has stewards maintaining business definitions, data integrity rules, and domain values. The names vary across documents: SP 800-88 Rev. 2 pairs “Information Owner/Steward” and calls the CIO “the information custodian” (NIST 2025), so read for the function rather than the label.

The data operator has no CompTIA definition. My reading, offered as interpretation: the person or automated process that handles the data day to day under rules others set, with no authority over classification or access. COPPA’s “operator” (16 CFR 312.2; eCFR 2026) is a different thing: it runs a website that collects children’s personal information, which is a controller-like role, so do not import that definition into a data-handling question.

The second layer is legal. The data controller “determines the purposes and means of the processing of personal data” (GDPR Art. 4(7)), and the EDPB says it is “usually the organisation as such,” not a person (EDPB 2021). A processor acts on the controller’s behalf (Art. 4(8)). The GDPR never uses the word “subprocessor”: Art. 28(2) bars a processor from engaging “another processor without prior specific or general written authorisation of the controller” (European Union 2016). Sub-processor is the EDPB’s term, and the contracts’ term, for that second processor. Under general authorization, the processor gives notice of changes, the controller may object, and silence can count as approval (EDPB para. 157). Obligations flow down by contract, and the initial processor “shall remain fully liable to the controller” (Art. 28(4)).

A SaaS HR deployment shows all seven parties at once (Contoso is illustrative):

Party	Role	What it does
Contoso, the employer	Data controller	Decides why and how employee data is processed
VP of HR	Data owner	Classifies the data Confidential, approves access and retention
HRIS analyst	Data steward	Defines fields such as termination date; runs quality checks
IT identity and SaaS admins	Data custodian	SSO, roles, tenant region, encryption, exports, audit logs
HR generalists, payroll clerk	Data operator (interpretation)	Enter and process records under those rules
SaaS HR vendor	Processor (covered at T-4)	Processes on Contoso’s documented instructions
IaaS provider hosting the SaaS	Data subprocessor	Listed with its region, authorized, bound by flowed-down terms

Two things in the table deserve a second look. The owner is a role inside Contoso; the controller is Contoso itself. And not every downstream party is a subprocessor: in the EDPB’s payroll example, the bank that executes payments is a separate controller.

Data handling: marks, labels, and lines on a map

Data handling is the set of controls that act on a classification once it exists. Two of the five SY0-801 handling items, marking and labeling, are the mechanism by which a classification becomes visible to people and to software. The other three, endpoints, data location, and data placement, concern where copies of the data are and where they are permitted to be.

Marking and labeling

SP 800-53 Rev. 5 control PE-22 draws the line: “Security marking refers to the use of human-readable security attributes. Security labeling refers to the use of security attributes for internal system data structures” (NIST 2020). A mark is a header, footer, or watermark a person can read; a label is metadata a program can read and act on. A Microsoft Purview sensitivity label does both: it applies content markings and writes persistent metadata in clear text (Microsoft 2026a). One labeled .docx looks like this (Microsoft’s key names and bit values; invented GUIDs):

Content marking, what a person sees:
Header: CONFIDENTIAL: CONTOSO HR ONLY
Footer: Classification: Confidential (HR)

Custom document properties, what software sees:
MSIP_Label_6f1e2c4a-9b3d-4e8a-a1c7-2d5e8f0b3a91_Enabled     = true
MSIP_Label_6f1e2c4a-9b3d-4e8a-a1c7-2d5e8f0b3a91_SetDate     = 2026-10-30T09:14:22-0400
MSIP_Label_6f1e2c4a-9b3d-4e8a-a1c7-2d5e8f0b3a91_Method      = Privileged
MSIP_Label_6f1e2c4a-9b3d-4e8a-a1c7-2d5e8f0b3a91_Name        = Confidential-HR
MSIP_Label_6f1e2c4a-9b3d-4e8a-a1c7-2d5e8f0b3a91_SiteId      = 0b7c3e2d-1111-4a2b-9c3d-000000000000
MSIP_Label_6f1e2c4a-9b3d-4e8a-a1c7-2d5e8f0b3a91_ContentBits = 11

ContentBits 11 is header 0x1 plus footer 0x2 plus encrypt 0x8. Method Privileged means a user chose the label; Standard means a default or automatic one (Microsoft 2026b). A DLP rule with the condition “Content contains: Sensitivity labels” can then block Copy to USB removable device (DLP is at T-16). That is the practical difference between the two halves of PE-22: a footer blocks nothing; a label read by software can.

Endpoints

Endpoints are the data location an organization controls least, because a laptop can copy a file to places no server-side control sees. Microsoft’s Endpoint DLP activities map the exits: USB, network shares, print, clipboard, restricted cloud uploads, RDP, and Bluetooth; a file never saved locally cannot be inspected. SP 800-53r5 MP-7 prohibits portable storage devices “when such devices have no identifiable owner,” which is the policy counterpart to the USB block in the DLP rule above.

Location and placement

Five location terms are easy to confuse, and each has a different job:

• Geolocation: “Determining the approximate physical location of an object, such as a cloud computing server” (NIST 2026). It answers where something is and enforces nothing.
• Geofencing: enforcing policy at a location boundary, such as a Conditional Access block on an Entra named location listing countries the organization never operates from. A VPN or proxy changes the IP Entra sees, so it is a layer, not a sole control (T-21).
• Data location: where every copy actually sits: replicas, backups, logs, caches, endpoints. SP 800-53r5 CM-12 requires documenting it.
• Data placement: where a class of data may live, enforced by design. SP 800-53r5 SA-9(5) restricts processing and storage to organization-defined locations.
• Data sovereignty (whose law applies) is covered at T-22.

A placement guardrail from the AWS Organizations documentation (AWS 2026):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyAllOutsideEU",
    "Effect": "Deny",
    "NotAction": ["cloudfront:*", "iam:*", "route53:*", "support:*"],
    "Resource": "*",
    "Condition": {"StringNotEquals": {"aws:RequestedRegion": ["eu-central-1", "eu-west-1"]}}
  }]
}

This service control policy (SCP) denies API actions outside two EU Regions, exempting global services, and grants nothing on its own. It is placement, not location: it stops new resources from landing in the wrong Region, and it cannot see copies that already exist elsewhere. Location is answered by the CM-12 inventory; placement is answered by a guardrail like this one.

The data management life cycle

The five SY0-801 stages are Creation, Management, Distribution, Retention, and Disposal. They map onto the Cloud Security Alliance’s 2017 six-phase model (Create, Store, Use, Share, Archive, Destroy) if Management absorbs Store and Use; that mapping is mine, not CompTIA’s (CSA 2017). The value of a life cycle is that it gives every control a stage to belong to and gives an auditor a place to ask for evidence:

Stage	Controls	Evidence an auditor asks for
Creation	Classify and label; default or mandatory labeling	Label coverage report, labeling policy
Management	Access control, encryption at rest, quality checks	Access reviews, CM-12 location inventory
Distribution	Label-driven encryption, DLP on sharing and endpoints	DLP incident logs, sharing reports
Retention	Schedule tied to legal requirements; holds suspend disposal	Schedule, retention labels, hold notices
Disposal	SP 800-88 method by categorization and reuse, then validation	Certificates of sanitization, chain of custody

Retention ties the life cycle to legal requirements: the schedule says how long each class is kept, and a hold suspends disposal. SP 800-53r5 SI-12 says retention requirements “cover the full life cycle of information” (NIST 2020); retention policy and legal hold are covered at T-7 and T-4.

Data has a life cycle, and so do the assets that carry it. SY0-801 objective 4.2 covers the asset management life cycle; its Planning/scoping item most plausibly means deciding which assets, data, and clouds are in scope before purchase, and NIST CSF 2.0 ID.AM-08 says systems, hardware, software, services, and data “are managed throughout their life cycles” (NIST 2024). The two life cycles meet at the end, when a drive that held classified data leaves service.

Disposal and media sanitization

Disposal is the last stage of the data life cycle and of the asset life cycle, and the standard that governs it is NIST SP 800-88. Rev. 2 (final September 26, 2025) supersedes Rev. 1 from December 2014 (NIST 2025). It defines three sanitization outcomes. Clear defeats simple, non-invasive recovery through the normal interface. Purge defeats state-of-the-art laboratory recovery while leaving the media reusable. Destroy defeats laboratory recovery and leaves the media unable to store data. Which one applies depends on how the data was categorized and where the media goes next, and Rev. 2’s Figure 1 turns that into a decision flow:

Categorization	Reused, stays in org control	Reused, leaves org control
Low or Moderate	Clear	Purge
High	Purge	Destroy

Media that will not be reused goes straight to destroy; every path ends in validation, then documentation or a loop back. Rev. 2 also retires some folklore: multi-pass overwrite is unnecessary, degaussing is not a destroy technique (on an SSD it can “complete successfully, but no sensitive data is sanitized”), and Rev. 1’s per-media tables give way to IEEE 2883. Two words carry weight in the standard. Verification asks whether the technique completed; validation asks whether it worked for this data. The record that proves both is a certificate of sanitization: device, method, technique, tool and version, verification, and signers. For cloud storage, cryptographic erase “may be the only viable purge sanitization technique option,” so a placement decision made at the start of the life cycle constrains disposal at its end.

What you need to know for SY0-801

• Owner decides and is accountable; custodian implements. “Who runs the backup” is the custodian; “who sets backup retention” is the owner.
• Steward means definitions, metadata, and quality; inconsistent field values point to the steward.
• Operator has no CompTIA definition; read it as whoever handles data daily under others’ rules (interpretation).
• A VP who approves access is the owner; the company deciding why data is processed is the controller. A subprocessor is engaged by a processor with the controller’s prior written authorization, and the processor stays fully liable.
• Marking is human-readable; labeling is machine-readable and enforceable.
• Geolocation (701-era vocabulary) locates; geofencing enforces. Location is where copies are; placement is where they are allowed. “Regulated data found in an unapproved region” is a placement failure.
• Data placement (3.3) is not device placement (3.2), and 3.3 Endpoints is not 4.1 Endpoint security.
• The five life cycle stages are Creation, Management, Distribution, Retention, and Disposal; the retention schedule and any hold decide when disposal may begin.
• Cryptographic erase is purge, not destroy; degaussing does not sanitize an SSD; proof of disposal is a certificate of sanitization.

Check yourself

These are original practice questions, not exam items.

1. A SaaS payroll vendor plans to move its hosting to a new IaaS provider. The customer’s contract grants the vendor general written authorization to use sub-processors. What must the vendor do?

• A. Nothing, because hosting providers are never processors.
• B. Notify the customer of the change, allow it to object, and flow the same data protection obligations down to the IaaS provider.
• C. Obtain consent from every employee whose data is stored.
• D. Transfer the controller role to the IaaS provider.

Answer: B. General authorization requires notice and a chance to object, and Art. 28(4) flows the same obligations down while the vendor stays fully liable. The IaaS provider becomes a subprocessor, not a controller.

2. HR reports disagree on headcount because the termination-date field holds three formats and two meanings. Which role should define the field and run data-quality checks?

• A. Data owner.
• B. Data custodian.
• C. Data steward.
• D. Data controller.

Answer: C. Stewards own business definitions, domain values, and quality. The custodian runs storage, access, and backups; the owner classifies and approves access.

3. Auditors find EU customer records in a bucket a developer created in us-east-1. Policy allows that data only in eu-central-1 and eu-west-1. Which control would have prevented the bucket’s creation?

• A. A conditional access policy that blocks sign-ins from outside the EU.
• B. A service control policy that denies actions when aws:RequestedRegion is not an approved EU Region.
• C. A sensitivity label with encryption enabled.
• D. A CM-12 inventory of information locations.

Answer: B. That is data placement enforced by design. Geofencing limits where users sign in, not where data lands, and the inventory records location after the fact.

This is T-18 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-17: Resilience Rewritten Around Immutable Backups and Recovery Metrics. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

AWS (Amazon Web Services). 2026. “Service Control Policy Syntax.” AWS Organizations User Guide. Accessed October 12, 2026.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CSA (Cloud Security Alliance). 2017. Security Guidance for Critical Areas of Focus in Cloud Computing. Version 4.0.

eCFR (Electronic Code of Federal Regulations). 2026. “16 CFR 312.2, Definitions.” Children’s Online Privacy Protection Rule. Version as of October 1, 2026.

EDPB (European Data Protection Board). 2021. Guidelines 07/2020 on the Concepts of Controller and Processor in the GDPR. Version 2.1.

European Union. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation). Official Journal of the European Union L 119.

Microsoft. 2026a. “Learn about Sensitivity Labels.” Microsoft Learn. See also “Use Sensitivity Labels as Conditions in DLP Policies,” “Learn about Endpoint Data Loss Prevention,” and “Conditional Access Policy: Using Network Signals.” Accessed October 12, 2026.

Microsoft. 2026b. “Concepts: Label Metadata in the MIP SDK.” Microsoft Learn. Accessed October 12, 2026.

NIST (National Institute of Standards and Technology). 2020. Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53, Revision 5.

NIST (National Institute of Standards and Technology). 2024. The NIST Cybersecurity Framework (CSF) 2.0. NIST Cybersecurity White Paper 29.

NIST (National Institute of Standards and Technology). 2025. Guidelines for Media Sanitization. By Ramaswamy Chandramouli and Eric Hibbard. NIST Special Publication 800-88, Revision 2.

NIST (National Institute of Standards and Technology). 2026. “Information Owner.” CSRC Glossary. See also “Geolocation” and “Data Steward.” Accessed October 12, 2026.