Module #6: Information Management from a US Perspective

Question 1

information management programs

Answer 1

developing programs to protect personal information is a critical step in adhering to laws and regulations on privacy and security

Question 2

privacy professionals

Answer 2

Assigning one or more privacy professionals to oversee the privacy and security programs helps to ensure compliance, provide training and assess risk when handling personal information.

Question 3

vendor relationships

Answer 3

Information

management expands into both contract and vendor relationships to protect info from being compromised

Question 4

incident response

Answer 4

development

of an incident response program in the event that information is compromised.

Question 5

Individual Roles of the privacy professional

Answer 5

includes:

• legal
• marketing
• sales
• human resource
• public and government relations
• information technology

Question 6

Privacy Professional is made up of:

Answer 6

– Researching laws, guidelines, common practices and tools; monitoring current events and changing guidelines to provide guidance to the organization

– Educating the organization about privacy laws, organizational policies, risks and recommended practices

–Designing and recommending policies and procedures for the organization

    - Monitoring and managing organizational risk as it is impacted by privacy issues and policies
    - Monitoring internal and external threats to privacy

Question 7

4 types of risk using privacy info

Answer 7

• legal risks
• reputational risks
• operational risks
• investment risks

Question 8

legal risks

Answer 8

– Not complying with privacy laws (state, federal and international)

– Not fulfilling contractual commitments

Question 9

Reputational risks

Answer 9

– Damaging trust in the brand: Organizations can face both legal enforcement and reputational harm if they do not adhere to their stated privacy policies

Question 10

Operational risks

Answer 10

– Affecting efficiency

– Inhibiting use of personal information that benefits the organization and customers

Question 11

Investment risks

Answer 11

– Hampering the ability of the organization to receive an appropriate return on its investments in information, IT and information processing programs

Question 12

Accountability consideration questions

Answer 12

• Where, how and for what length of time should the data be stored?
• How sensitive is the information?
• Should the information be encrypted?
• Will the information be transferred to or from other countries, and if so, how will it be transferred?
• What are each country’s privacy laws?
• Who determines the rules that apply to the information?
• How will the information be processed, and how will these processes be maintained?
• Is the use of PI dependent upon other systems?

Question 13

What are the 4 steps of developing an information management program?

Answer 13

1) Discover
2) Build
3) Communicate
4) Evolve

Question 14

What should you consider during the Discover process (1st step of developing an information management program)

Consider?

Answer 14

• Accountability
• Company policy goals
• PI data inventory
• Data locations
• Data sharing
• Data transfers
• Data flows
• Data classification
• Data risk

Question 15

What tasks are included during the Discover process (1st step of developing an information management program)

Tasks?

Answer 15

Tasks include:
• Self-assessing and identifying privacy risk
• Classifying PI according to sensitivity
• Developing and documenting best practices

Question 16

Build task

Definition?

(2nd step of developing an information management program)

Answer 16

Once an assessment of practices and goals is complete, determine how best to meet those goals by building a privacy program that both facilitates and restricts the flow
of personal information (as appropriate).

Question 17

Build task

What does this include?

(2nd step of developing an information management program)

Answer 17

– Internal privacy policies
o Enforceable legal documents (contracts)
o Policy reviews and monitor

– External privacy notices
o Common practices, sometimes required by law
o Promises to consumers
o Notice should accurately reflect policy and practices
o Version control
o Accessible online

Question 18

Communicate task

3rd step of developing an information management program

Answer 18

Even a well-constructed privacy program will not be successful if those involved in handling PI are not fully trained.

Communication is key, as well as:
o Documenting and updating policies and procedures
o Communicating policies, procedures & goals to decision-makers and consumer-facing employees
o Training and awareness programs for staff and management
o Individual accountability for compliance

Question 19

Evolve task

4th step of developing an information management program

Answer 19

Information management practices evolve in response to changing technologies, laws, market conditions and other factors.

Once an information management program is established, there must be a process for review and update.

Failure to do so can result in a company falling out of compliance with its public privacy promises or
failing to meet other organizational goals.

Question 20

Key actions of the Evolve tasks?

4th step of developing an information management program

Answer 20

Key actions include:

– Affirmation and monitoring
o Do policies and practices still comply with law, conform with company needs and support incident response programs?

– Adaptation
o What changes are necessary to comply with new laws, current company goals and industry practices?

Question 21

Training

Answer 21

–Should be provided regularly especially to those working with sensitive data and keep records

–training may provide a script to customer service representatives to help them provide or direct customers to the org’s outward-facing privacy notice

–clarify when issues and incidents should be escalated

– Everyone who handles personal
information, including those who make decisions regarding it, such as leadership, should be trained in privacy

–Training should be tailored to individual roles and responsibilities

Question 22

User preferences

Answer 22

-keep in mind consumer preferences and rights regarding data access and correction

–opt-in and opt-out:
&raquo_space;users should have the choice to opt-in before data is used or collected and opt-out of info being sold or shared with 3rd parties

–no option:
»the customers should expect their info to be shared with 3rd parties or used in other ways, as thru 3rd party shipping, fraud prevention or 1st party marketing

–when org’s have multiple business units, preference management can be challenging but essential

–Access and correction:
»users should have access to personal info held about them as well as the ability to challenge the accuracy of the data

Question 23

Incident Response programs

> > 6 steps are?

Answer 23

1) Preparation
2) Identification
3) Containment
4) Eradication
5) Recovery
6) Lessons learned

Question 24

Incident Response programs

step #1: Preparation

Answer 24

Preparing users and IT staff to handle potential incidents

Question 25

Incident Response programs

step #2: Identification

Answer 25

Determining whether an event is, indeed, a security incident

Question 26

Incident Response programs

step #3: Containment

Answer 26

Limiting the damage of the incident and isolating affected systems to prevent further damage

Question 27

Incident Response programs

step #4: Eradication

Answer 27

Finding the root cause of the incident and removing affected systems from the production environment

Question 28

Incident Response programs

step #5: Recovery

Answer 28

Permitting affected systems back into the production environment and ensuring no threat remains

Question 29

Incident Response programs

step #6: Lessons learned

Answer 29

Completing incident documentation and performing analysis to learn from the incident and potentially improve future response efforts

Question 30

What should current incident response programs need to address

Answer 30

cyberthreats (such as ransomware or cyberbullying)

Question 31

Vendor Due Diligence Checklist

Answer 31

• • Vendor reputation
• • Prior security incidents
• • Financial Condition
• • Information Security controls
• • Point of transfer
• • Disposal of information
• • Employee training and user awareness
• • Vendor incident response
• • Privacy impact assessments

Question 32

Data classification

Answer 32

The classification level assigned to data defines the clearance of individuals who can access or handle that data, as well as the baseline level of protection that is appropriate for that data.

– An organization’s inventory of personal information being processed should include PI that is collected, used, stored or disclosed, whether internally or externally

– The inventory can then be classified based on the sensitivity level of the data; levels may include confidential, proprietary, sensitive, restricted and public data

– Once data has been classified, segregate highly sensitive data from less sensitive data, such as through use of access controls

Question 33

What types of risk should an organization consider when designing and administering a
privacy program? Select all that apply.

A) Legal
B) Reputational
C) Operational
D) Investment
E) Resources

Answer 33

A, B, C, D (all but resources)

Legal, reputational, operational, investment.

Question 34

What are the four steps involved in the development of a privacy program?

A) Discover, build, communicate, evolve
B) Research, design, build, audit
C) Brainstorm, propose, implement, follow-through
D) Test, learn, revise, monitor

Answer 34

A

Discover, build, communicate, evolve.

Question 35

Who may need privacy training? Select all that apply.

A) Customer service representatives
B) Leaders at the executive level
C) Marketing managers
D) Sales executives
E) IT staff

Answer 35

All of the above

• -Customer service representatives
• -leaders at the executive level
• -marketing managers
• -sales executives
• -IT staff

Question 36

Which step in the process for developing an incident response program involves permitting
affected systems back into the production environment and ensuring no threat remains?

A) Containment
B) Eradication
C) Recovery
D) Lessons learned

Answer 36

C) Recovery

Question 37

Which is not a reason for assigning classification levels to personal data?

A)_Defining the clearance of individuals who can access or handle the data
B)_Determining the data’s sensitivity based on the level of pseudonymization
C)_Identifying the baseline of protection that is appropriate for the data
D)_Using the classification levels to segregate highly sensitive data from less sensitive
data

Answer 37

B)

Determining the data’s sensitivity based on the level of pseudonymization