Security protects data and systems from unauthorized access, disclosure, alteration, or destruction. In privacy-centric marketing, it is the foundation of trust and an organizational responsibility, not merely a technical task. section 2.2
A practical security posture combines:
- Encryption for data in transit and at rest. section 2.2 section 4.4.6
- Access controls that limit who can use sensitive information. section 2.2
- Ongoing audits and a clear incident response plan. section 2.2
- Privacy by design, with cross-functional review before collecting data and a preference for collecting less. section 2.2
Security also shapes technology selection. Evaluate how a solution stores, processes, and transmits first-party data; whether it satisfies organizational compliance goals; and whether security leaders will approve its handling of sensitive information. section 4.4.6
When weak security destroys trust
The 2017 Equifax breach exposed sensitive information for more than 140 million people and rapidly damaged public confidence. The example shows why security failures can become business and reputation failures. section 2.2
Figure 2.1 Core elements of user privacy
Use the privacy-elements figure to relate security to transparency, user control, data minimization, purpose limitation, and privacy by design. section 2.2
Table 4.7 Security and compliance considerations
| Solution |
Considerations |
| Composable CDPs |
(+) Most composable CDPs maintain very high standards of security (SOC 2 and ISO 27001 certifications), and some will meet industry-specific regulatory requirements. No third-party data hosting is a major benefit to security. |
| Marketing clouds/engagement platforms |
(+/-) MCs maintain very high security standards, but they may not sign BAAs for healthcare customers or meet other industry-specific regulatory requirements. |
| Monolithic CDPs |
(+) The leading monolithic CDPs maintain very high standards of security, and some industry-specific CDPs will meet industry-specific regulatory requirements. Since CDPs must host your data, be wary of second-tier or third-tier CDPs that are not SOC 2 or ISO 27001 certified. |
| In-house builds |
(+/-) The fact that first-party data is hosted in the organization’s own systems is a considerable advantage, but security implementation varies widely from one build to the next. It is critical to factor in ongoing maintenance for all API integrations and application patches, or vulnerabilities will likely emerge over time. |
Compare security and compliance trade-offs across composable CDPs, marketing clouds, monolithic CDPs, and in-house builds. section 4.4.6
