When configuring information systems for the communication and transport of personal data, an organization should:

Information systems must be configured to meet specific legal, regulatory, and policy requirements for protecting personal data. Simply adopting defaults or enabling minimal features is insufficient. A systematic review of configuration settings against a compliance baseline (derived from regulations like GDPR, CCPA, etc.) is essential. This ensures that technical controls correctly implement privacy principles such as data minimization, purpose limitation, and security, thereby demonstrating due care and adherence to Privacy by Design.

A. Default vendor specifications are often designed for functionality over security and privacy and may not comply with relevant regulations.
C. A "least restrictive" mode is the opposite of security and privacy best practices, which call for the principle of least privilege.
D. Enabling only essential capabilities is a good practice (data minimization), but it is only one part of a comprehensive compliance review.

1. ISACA, CDPSE Review Manual, 1st Edition, Domain 3: Data Protection, Task 3.1 (Identify data protection and privacy controls), Knowledge Statement K3.1.3 (Knowledge of privacy by design principles and techniques).

2. Cavoukian, A. (2009). Privacy by Design: The 7 Foundational Principles. Information and Privacy Commissioner of Ontario, Canada. Principle 2, "Privacy as the Default Setting," explicitly states that default settings should be maximally privacy-protective.

3. National Institute of Standards and Technology (NIST). (2021). NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0. Section 2.3, Core, Control (PR.IP-P10), discusses configuring systems to support privacy principles.