CIPM BOK Outline Flashcards
(39 cards)
1
Q
Privacy Program Governance - 4 main subcategories
A
- Organizational Level
- Develop the Privacy Program Framework
- Implement the Privacy Program Framework
- Metrics
2
Q
Governance: Organizational Level - 4 main subcategories
A
- Create a company vision
- Establish Data Governance Model
- Establish a privacy program
- Structure the Privacy Team
3
Q
Create a company vision
Gov., Org level
A
- Acquire knowledge on privacy approaches
- Evaluate the intended objective
- Gain executive sponsor approval for this vision
4
Q
Establish Data Governance Model
Gov., Org level
A
- Centralized
- Distributed
- Hybrid
5
Q
Establish a Privacy Program
Gov., Org Level
A
- Define program scope and charter
- Identify the source, types, and uses of personal information within the organization and the applicable laws
- Develop a Privacy Strategy
6
Q
Privacy Strategy
Gov., Org level, privacy program
A
- Business alignment– finalize the operational business case for privacy, identify stakeholders, leverage key functions, create a process for interfacing within organization, align organizational culture and privacy/data protection objectives, and obtain funding/budget for privacy and the privacy team
- Develop a data governance strategy for personal information (collection, authorized use, access, and destruction)
- Plan inquiry/complaint handling procedures (customers, regulators, etc)
7
Q
Structure the Privacy team
Gov., Org level
A
- Establish the organizational model, responsibilities, and reporting structure appropriate to the size of the organization
- Designate a point of contact for privacy issues
- Establish/endorse the measurement of professional competency
8
Q
Large Organization Structure
A
- Chief Privacy Officer
- Privacy Manager
- Privacy Analysts
- Business line privacy leaders
- “First Responders”
9
Q
Small Organization Structure
A
Sole Data Protection Officer (DPO)
10
Q
Privacy Program Development
Gov
A
- Develop organizational privacy policies, standards, and/or guidelines
- Define privacy program activities
11
Q
Privacy Program Activities
Gov, Program Framework
A
- Education and Awareness
- Monitoring and responding to the regulatory environment
- Internal policy compliance
- Data inventories, data flows, and classification
- Risk assessments (PIAs, PTAs, etc)
- Incident Response and process, including jurisdictional regulations
- Remediation
- Program assurance, including audits
12
Q
Privacy Program Implementation
Gov
A
- Communicate the framework to internal and external stakeholders
- Ensure continuous alignment to applicable laws and regulations to support the development of an organizational privacy program framework
13
Q
Ensuring continuous alignment of program
Gov, Program Implementation
A
- Understand when national laws and regulations apply (e.g., GDPR, CCPA)
- Understand when local laws and regulations apply
- Understand penalties for noncompliance with laws and regulations
- Understand the scope and authority of oversight agencies (e.g., Data Protection Authorities, Privacy Commissioner, FTC, etc.)
- Understand privacy implications of doing business with or basing operations in countries with inadequate, or without, privacy laws
- Maintain the ability to manage a global privacy function
- Maintain the ability to track multiple jurisdictions for changes in privacy law
- Understand international data sharing arrangement agreements
14
Q
Metrics
Gov
A
- Identify intended audience for metrics
- Define reporting resources
- Define privacy metrics for oversight and governance per audience
- Identify systems/application collection points
15
Q
Defining Privacy Metrics
Gov., Metrics
A
- Compliance metrics (i.e., collection, responses to data subject inquiries, use, retention, disclosure to third parties, incidents- breaches, complaints, inquiries- employees trained, PIA metrics, privacy risk indicators, percent of company functions represented by governance mechanisms)
- Trending
- Privacy program return on investment
- Business resiliency metrics
- Privacy program maturity levels
- Resource utilization
16
Q
Privacy Operational Life Cycle
A
- Assess your organization
- Protect
- Sustain
- Respond
17
Q
Assess
life cycle
A
- Document current baseline of your privacy program
- Processors and third-party vendor assessment
- Physical assessments
- Mergers, acquisitions, and divestitures
- Conduct analysis and assessments, as needed or appropriate
18
Q
Current baseline documentation
Life cycle, Assess
A
- Education and Awareness
- Monitoring and responding to the regulatory environment
- Internal policy compliance
- Data, systems, and process assessment (map data inventories, flows, and classifications, create “Record of Authority” of systems processing personal information within the organization, map and document data flow in systems and applications, and analyze and classify types and uses of data)
- Risk assessments (PIAs, PTAs, etc)
- Incident Response
- Remediation
- Determine desired state and perform gap analysis against an accepted standard or law
- Program assurance, including audits
19
Q
Processors and third-party vendor assessment
Life Cycle, Assess
A
- Evaluate processors and third-party vendors, insourcing and outsourcing privacy risks, including rules of international data transfer (Privacy and info security policies, access controls, where PI is being held, and who has access to PI)
- Understand and leverage the different types of relationships (internal audit, info security, physical security, data protection authority)
- Risk assessment (type of data being outsourced, location of data, implications of cloud computing strategies, legal compliance, records of retention, contractual requirements like incident response, and establish minimum standards for safeguarding information
- Contractual requirements
- Ongoing monitoring and auditing
20
Q
Physical Assessments
Life Cycle, Assess
A
Identify operational risk in:
- Data centers and offices
- Physical access controls
- Document destruction
- Media sanitization and disposal (e.g., hard drives, USB/thumb drives)
- Device forensics
- Device security (e.g., mobile devices, IoT, geo-tracking, imaging/copier hard drive security controls
21
Q
Mergers, Acquisitions, and Divestitures
Life Cycle, Assess
A
- Due diligence
2. Risk assessment
22
Q
Conduct analysis and assessments, as needed or appropriate
Life Cycle, Assess
A
- PTAs on systems, applications, and processes
- PIAs - define the process for conducting, understand the life cycle of a PIA and incorporate PIAs into system, process, product life cycles
23
Q
Protect
Life Cycle
A
- Data Life Cycle and governance (creation to deletion)
- Info security practices (Access controls for physical and virtual systems, technical security controls, implement appropriate administrative safeguards
- Privacy by Design (integrate PbD throughout the system development life cycle & establish privacy gates as part of the system development framework)
24
Q
Sustain
Life Cycle
A
- Measure
- Align
- Audit
- Communicate
- Monitor
25
Measure
| Life cycle, sustain
1. Quantify the costs of technical controls
2. Manage data retention with respect to the organization's policies
3. Define the methods for physical and electronic data destruction
4. Define roles and responsibilities for managing the sharing and disclosure of data for internal and external use
26
Align
| Life cycle, sustain
Integrate privacy requirements and representation into functional areas across the organization:
1. Information security
2. IT operations and development
3. Business continuity and disaster recovery planning
4. Mergers, acquisitions, and divestitures
5. Human resources
6. Compliance and ethics
7. Audit
8. Marketing/business development
9. Public relations
10. Procurement/sourcing
11. Legal and contracts
12. Security/emergency services
13. Finance
14. Others
27
Audit
| Life Cycle, sustain
1. Align program privacy operations to an internal and external compliance audit program (knowledge of audit processes & align to industry standards)
2. Audit compliance with privacy policies and standards
3. Audit data integrity and quality and communicate audit findings with stakeholders
4. Audit information access, modification, and disclosure accounting
28
Communicate
| Life cycle, sustain
1. Awareness
| 2. Targeted employee, management, and contractor training
29
Communicating Awareness
| Life cycle, sustain
1. Create awareness of the organization's privacy program internally and externally
2. Ensure policy flexibility in order to cooperate legislative/regulatory/market requirements
3. Develop internal and external communication plans to ingrain organizational accountability
4. Identify, catalog, and maintain documents requiring updates as privacy requirements change
30
Communicating Training
| Life Cycle, Sustain
For targeted employee, management, and contractor training:
1. Privacy policies
2. Operational privacy practices (e.g., standard operating instructions), such as data creation/usage/retention/disposal, access control, reporting incidents, and key contacts
31
Monitor
| Life Cycle, Sustain
1. Environment (e.g., systems, applications) monitoring
2. Monitor compliance with established privacy policies
3. Monitor regulatory and legislative changes
4. Compliance monitoring (e.g., collection, use, and retention) with internal audit, self-regulation, retention strategy, exit strategy
32
Respond
| Life Cycle
1. Information Requests
| 2. Privacy incidents
33
Responding to Information Requests
| Life Cycle, Respond
1. Access
2. Redress
3. Correction
4. Managing data integrity
34
Responding to Privacy Incidents
| Life Cycle, Respond
1. Legal Compliance
2. Incident Response Planning
3. Incident detection
4. Incident Handling
5. Follow incident response process to ensure meeting jurisdictional, global, and business requirements
6. Identify incident reduction techniques
7. Incident metrics--quantify the cost of a privacy incident
35
Legal Compliance in Incident Response
| Life Cycle, Respond
1. Preventing harm
2. Collection limitations
3. Accountability
4. Monitoring and enforcement
36
Incident Response Planning
| Life Cycle, Response
1. Understand key roles and responsibilities by Identifying key business stakeholders (info security, legal, audit, human resources, marketing, biz development, communications and PR, and other) & establishing oversight team
2. Develop a privacy incident response plan
3. Identify elements of the privacy incident response plan
4. Integrate privacy incident response into business continuity planning
37
Incident Detection
| Life Cycle, Response
1. Define what constitutes a privacy incident
2. Identify reporting process
3. Coordinate detection responsibilities with Organization IT, Physical Security, Human resources, Investigation teams, and vendors
38
Incident Handling
| Life Cycle, Response
1. Understand key roles and responsibilities
| 2. Develop a communications plan to notify executive management
39
Incident Response Process
| Life Cycle, Response
1. Engage privacy team
2. Review the facts
3. Conduct analysis
4. Determine actions (contain, communicate, etc.)
5. Execute
6. Monitor
7. Review and apply lessons learned
