Cipm Privacy Operational Life Cycle By Rps

Front 1

What are the four components of the Privacy Operational Life Cycle?

Back 1

1. Assessing your organization
2. Protecting your data
3. Sustaining your program
4. responding to issues

Front 2

What are the five aspects you use to "Assess" your organization?

Back 2

1. Document current privacy baseline
2. Processors and third-party vendor assessment
3. Physical assessments
4. Mergers, acquisitions and divestiture
5. Conduct analysis and assessments, as needed or appropriate

Front 3

... what are the 9 things and their sub-components you need to document in the current baseline of your privacy?

Back 3

i. Education and awareness
ii. Monitoring and responding to the regulatory environment
iii. Internal policy compliance
iv. Data, systems and process assessment
1. Map data inventories, flows and classification
2. Create “record of authority” of systems processing personal information within organization
3. Map and document data flow in systems and applications.
4. Analyze and classify types and uses of data
v. Risk assessment (PIAs, etc.)
vi. Incident response
vii. Remediation
viii. Determine desired state and perform gap analysis against an accepted standard or law
ix. Program assurance, including audits

Front 4

When you perform a processors and third-party vendor assessment, what are the 5 things you have to do?

Back 4

i. Evaluate processors and third-party vendors in-sourcing and outsourcing privacy risks
ii. Understand and leverage the different types of relationships
iii. Risk assessment
iv. Contractual requirements
v. Ongoing monitoring and auditing

Front 5

Let's break out how you evaluate processors and third-party vendors... in-sourcing and out-sourcing privacy risks...how do you do that? What 4 things do you look at?

Back 5

With...
1. Privacy and information security policies.
2. Access controls.
3. Understanding where personal information is being held...
and..
4. Who has access to personal information

Front 6

To meet Privacy goals, who do you work on better understanding and leveraging different types of relationships with? What four groups?

Back 6

1. Internal audit.
2. Information security.
3. Physical security.
4. Data protection authority.

Front 7

What seven things are involved in a risk assessment?

Back 7

1. Type of data being outsourced
2. Location of data
3. Implications of cloud computing strategies
4. Legal compliance
5. Records retention
6. Contractual requirements (incident response, etc.)
7. Establish minimum standards for safeguarding information

Front 8

What are the seven areas of operational risk?

Back 8

1. Data centers
2. Physical access controls
3. Document destruction
4. Media sanitization (e.g., hard drives, USB/thumb drives, etc)
5. Device forensics
6. Fax machine security
7. Imaging/copier hard drive security controls

Front 9

What are the two things you need to do relating to mergers, acquisitions and divestiture?

Back 9

i. Due diligence.
ii. Risk assessment.

Front 10

What are a couple of things that will help you with your analysis and assessments?

Back 10

i. Privacy Threshold Analysis (PTAs) on systems, applications and processes
ii. Privacy Impact Assessments (PIAs)

Front 11

What two things do you need to do as you define a process for conducting Privacy Impact Assessment?

Back 11

a. Understand the life cycle of a PIA.
b. Incorporate PIA into system, process, product life cycles.

Front 12

Ok then, so how do you "Protect" your organization in relation to privacy infractions? Name three elements please...

Back 12

By using:
a. Data life cycle (creation to deletion).
b. Information security practices.
c. Privacy by Design.

Front 13

What three choke-points can you implement in your Information security practices?

Back 13

i. Access controls for physical and virtual systems
ii. Technical security controls.
iii. Implement appropriate administrative safeguards.

ii. Technical security controls
iii. Implement appropriate administrative safeguards

Front 14

Tell me more about the three access controls for physical and virtual systems...

Back 14

1. Access control should be based on "need to know".
2. Account management (e.g. provision process).
3. Privilege management.

Front 15

What are the two elements of "Privacy by Design"?

Back 15

it.s when you....
i. Integrate privacy throughout the system development life cycle (SDLC)
ii. Establish privacy gates/PIAs-Data Protection Impact Assessments (DPIAs) as part of the standard process, system development framework.

Front 16

The "sustain" portion of Privacy Operational Life Cycle sounds huge. The acronym is MAACM What's involved?

Back 16

a. Measure
b. Align
c. Audit
d. Communicate
e. Monitor

Front 17

The "Measure" portion under "Sustain" what four tasks does that consist of?

Back 17

i. Quantify the costs of technical controls
ii. Manage data retention with respect to the organization’s policies
iii. Define the methods for physical and electronic data destruction
iv. Define roles and responsibilities for managing the sharing and disclosure of data for internal and external use

Front 18

The "Align" efforts under "Sustain" what 13+ groups do you need to align with?

Back 18

Aligning your efforts with
1. Information security
2. IT operations and development
3. Business continuity and disaster recovery planning
4. Mergers, acquisitions and divestitures
5. Human resources
6. Compliance and ethics
7. Audit
8. Marketing/business development
9. Public relations
10. Procurement/sourcing
11. Legal arid contracts
12. Security/emergency services
13. Finance
14. Others

Front 19

What are the 5 considerations in the "Audit" step under "Sustain"?

Back 19

i. Align privacy operations to an internal and external compliance audit program
1. Knowledge of audit processes
2. Align to industry standards
ii. Audit compliance with privacy policies and standards
iii. Audit data integrity and quality
iv. Audit information access, modification and disclosure accounting
v. Communicate audit findings to stakeholders

Front 20

The "Communicate" portion under "Sustain" what does that consist of? The two sections are Awareness and training. Please break out the 4 activities under awareness and the 2 (plus sub-activities) under training.

Back 20

i. Awareness
1. Create awareness of the organization’s privacy program internally and externally
2. Ensure policy flexibility in order to incorporate legislative/regulatory/market requirements
3. Develop internal and external communication plans to ingrain organizational accountability
4. Identify, catalog and maintain documents requiring updates as privacy requirements change
ii. Targeted employee, management and contractor training
1. Privacy policies
2. Operational privacy practices (e.g, standard operating instructions), such as
a. Data creation/usage/retention/disposal
b. Access control
c. Reporting incidents
d. Key contacts

Front 21

The 4 "Monitor"-ing elements under "Sustain" what are they?

Back 21

i. Environment (e.g., systems, applications) monitoring.
ii. Monitor compliance with established privacy policies.
iii. Monitor regulatory and legislative changes.
iv. Compliance monitoring (e.g. collection, use and retention).

Front 22

Let's investigate "compliance monitoring" from the "Monitor" section and go into more detail. What are the 4 areas of effort here?

Back 22

1. Internal audit
2. Self-regulation
3. Retention strategy
4. Exit strategy

Front 23

Related to "Privacy Operational Life Cycle"; which two things do you "Respond" to, for your organization?

Back 23

a. Information requests
b. Privacy incidents

Front 24

Related to "Privacy Operational Life Cycle"; and what you "Respond" with to information requests for your organization... What are these 4 request types typically related to?

Back 24

i. Access
ii. Redress
iii. Correction
iv. Managing data integrity

Front 25

Name the 6 "privacy incidents" you would be responding to under the Privacy Operational Life Cycle".

Back 25

i. Legal compliance.
ii. Incident response planning.
iii. Incident detection.
iv. Incident handling.
v. Follow incident response process to ensure meeting jurisdictional, global and business requirements.
vi. Identify incident reduction techniques.
vii. Incident metrics—quantify the cost of a privacy incident.

Front 26

What are the four considerations related to privacy incidents in terms of "legal compliance"?

Back 26

1. Preventing harm.
2. Collection limitations.
3. Accountability.
4. Monitoring and enforcement.

Front 27

What are the four considerations (and 8 sub components) related to privacy incidents in terms of "Incident Response handling"?

Back 27

1. Understand key roles and responsibilities.
a. Identify key business stakeholders.
i. Information security
ii. Legal
iii Audit
iv. Human resources
v. Marketing
vi. Business development
vii. Communications and public relations
viii. Other
b. Establish incident oversight teams.
2. Develop a privacy incident response plan.
3. Identify elements of the privacy incident response plan.
4. Integrate privacy incident response into business continuity planning.

Front 28

What are the 3 considerations related to privacy incidents in terms of "Incident Detection"?

Back 28

1. Define what constitutes a privacy incident
2. Identify reporting process
3. Coordinate detection capabilities
a. Organization IT
b. Physical security
c. Human resources
d. Investigation teams
e. Vendors

Front 29

What are two considerations related to privacy incidents in terms of "Incident handling"?

Back 29

1. Understand key roles and responsibilities.
2. Develop a communications plan to notify executive management.

Front 30

What are the seven things related to privacy incidents in terms of "Follow incident response process to ensure meeting jurisdictional, global and business requirements"?

Back 30

1. Engage privacy team
2. Review the facts
3. Conduct analysis
4. Determine actions (contain, communicate, etc.)
5. Execute
6. Monitor
7. Review and apply lessons learned