Proactive Privacy Management: Strategies and Best Practices, Exams of Nursing

Download Proactive Privacy Management: Strategies and Best Practices and more Exams Nursing in PDF only on Docsity! CIPM QUESTION & ANSWERS 2024 Proactive privacy management is accomplished through three tasks - Correct Answers ✅1) Define your organization's privacy vision and privacy mission statements 2) Develop privacy strategy 3) Structure your privacy team This is needed to structure responsibilities with business goals - Correct Answers ✅Strategic Management Identifies alignment to organizational vision and defines the privacy leaders for an organization, along with the resources necessary to execute the vision. - Correct Answers ✅Strategic Management model Member of the privacy team who may be responsible for privacy program framework development, management and reporting within an organization - Correct Answers ✅Privacy professional Strategic management of privacy starts by - Correct Answers ✅creating or updating the company's vision and mission statement based on privacy best practice Privacy best practices - Correct Answers ✅1) Develop vision and mission statement objectives 2) define privacy program scope 3)identify legal and regulatory compliance challenges 4) identify organization personal information legal requirements CIPM QUESTION & ANSWERS 2024 This key factor that lays the groundwork for the rest of the privacy program elements and is typically comprised of a short sentence or two that describe the purpose and ideas in less than 30 seconds. - Correct Answers ✅Vision or mission statement This explains what you do as an organization, not who you are; what the organization stands for and why what you do an an organization to protect personal information is done - Correct Answers ✅Mission Statement What are the steps in the five step metric cycle - Correct Answers ✅Identify, Define, Select, Collect, Analyze The first step in the selecting the correct metrics starts by what? - Correct Answers ✅Identifying the intended metric audience The primary audience for metrics may include - Correct Answers ✅Legal and privacy officers, senior leadership; CIO, CSO, PM, Information Systems Owner (ISO), Information Security Officer (ISO), Others considered users and managers The secondary audience includes those who may not have privacy as a primary task include - Correct Answers ✅CFO, Training organizations, HR, IG, HIPPA security officials CIPM QUESTION & ANSWERS 2024 Good metrics should not do what? - Correct Answers ✅Overburden the reader A metric should be clear in the meaning of what is being measured and what else? - Correct Answers ✅1) Rigorously defined, 2) Credible and relevant, 3) Objective and quantifiable 4) Associated with the baseline measurement per the organization standard metric taxonomy If a standard metric taxonomy does not exist, privacy professionals can generate their own using the best practices from where? - Correct Answers ✅NIST, NISTIR 7564, "Directions in Security Metrics Research" A mission statement should include what five items? - Correct Answers ✅Value the organization places on privacy, Desired organizational objectives, Strategies to drive the tactics used to achieve the intended outcomes, Clarification of roles and responsibilities Strategic Management assigns roles, sets expectations grants powers and what? - Correct Answers ✅Verifies performance This model identifies alignment to organization vision and defines the privacy leaders for an organization, along with the resources (people, policy, processes, and procedures) necessary to execute vision - Correct Answers ✅Strategic Management Model CIPM QUESTION & ANSWERS 2024 This is a key factor that lays the groundwork for the rest of the privacy program elements and is comprised of a short sentence or two that describes purpose and ideas in less than 30 seconds - Correct Answers ✅Mission Statement What are the four steps in defining your organization's privacy vision and privacy mission statements - Correct Answers ✅1. Develop Vision and Mission Statement Objectives 2. Define Privacy Program Scope 3.Identify Legal and Regulatory Compliance Challenges 4. Identify Organizational Personal Information Legal Requirements What are the steps of Strategic Management? - Correct Answers ✅Define Privacy and Mission, Develop Privacy Strategy, Structure Privacy Team This is someone who understands the importance of privacy and will act as an advocate for you and for the program. Typically, they will have experience with the organization, the respect of their colleagues and access to or ownership of budget. - Correct Answers ✅Program Sponsor This is an executive who acts as an advocate and sponsor to further foster privacy as a core organization concept - Correct Answers ✅Program Champion CIPM QUESTION & ANSWERS 2024 Individual executives who lead and "own" the responsibility of the relevant activities are called what? - Correct Answers ✅Stakeholders As a rule, privacy policies and procedures are created and enforced at a what level? - Correct Answers ✅Functional Policies imposing general obligations on employees may reside with whom? - Correct Answers ✅Ethics, legal and compliance Policies and procedures that dictate certain privacy and security requirements on employees as they relate to the technical infrastructure typically sit with whom? - Correct Answers ✅IT Policies that govern requirements that need to be imposed on provider of third-party services that implicate personal data typically sit with whom? - Correct Answers ✅Procurement Policies that govern the use and disclosure of health information about employees of the organization typically reside with whom? - Correct Answers ✅HR This approach collects the various data-protection requirements and rationalizes them where possible - Correct Answers ✅Pragmatic Approach CIPM QUESTION & ANSWERS 2024 This function is more closely aligned to the privacy group than any other function. - Correct Answers ✅Information Security (IS) This functional group adds processes and controls that support privacy principles. It creates processes to develop and test software and applications in a manner that does not require the use of production data decreases the chances that the data will be compromised and that individuals who have no business need will access the data - Correct Answers ✅Information Technology (IT) This functional group traditionally functions independently to assess whether controls are in place to protect personal information and whether people are abiding by these controls - Correct Answers ✅Internal audit group Many organizations create this, comprised of the same stakeholders that were identified at the start of the privacy program implementation process. Instrumental in making strategic decisions and driving such strategies and decisions through their own organizations. - Correct Answers ✅Privacy committee or council Organizations with a global footprint often create a governance structure that is comprised of whom? - Correct Answers ✅Representatives from each geographic region and business function (ie., HR) in which the organization has a presence to ensure that proposed privacy policies, processes, and solutions align with local laws. CIPM QUESTION & ANSWERS 2024 You first step when developing a Data-governance Strategy for Personal Information (Collection, Authorized Use, Access, Security, Destruction) - Correct Answers ✅Take an inventory of relevant regulations that apply to your business. Once you determine which laws apply, you must design a manageable approach to handling and protecting personal information This means implementing a solution that materially addresses the various requirements of the majority of laws or regulations with which you must comply. - Correct Answers ✅Rationalization Data-protection regulations typically include what items - Correct Answers ✅• Notice • Choice • Consent • Purpose limitations • Limits on retaining data • Individual rights to access • Correction and deletion of data • Obligation to safeguard data Privacy professionals should always involve whom to review, define or establish technical security controls, including common security CIPM QUESTION & ANSWERS 2024 controls such as firewalls, malware anti-virus, and complex password requirements - Correct Answers ✅Security Engineer This strategy seeks solutions that do not violate any data privacy laws, exceed budgetary restrictions or contradict organization goals and objectives - Correct Answers ✅Strictest Standard When positioning the privacy team, you should also consider the authority it will receive based on the what? - Correct Answers ✅Governance model it follows Executive leadership support for your governance model will have a direct impact on the level of success when implementing your privacy strategies. What are the important steps to integrate into any model? - Correct Answers ✅o Involve senior leadership o Involve stakeholders o Develop internal partnerships o Provide flexibility o Leverage communications o Leverage collaboration This type of governance fits well in organizations used to utilize single- channel functions (where direction flows from a single source) with planning and decision making completed by one group - Correct Answers ✅Centralized Governance CIPM QUESTION & ANSWERS 2024 o Disclosure to third parties o Incidents (breaches, complaints, inquiries) o Employee training o Privacy Impact Assessment o Privacy risk indicators o Percent of organization functions represented by governance mechanisms What are the steps of the Metric Life Cycle - Correct Answers ✅o Identify the intended audience - Who will use the data o Define the data sources - Who is the data owner and how is that data accessed o Select privacy metrics - what metrics to use based on the audience, reporting resources and final selection of the best metric o Collect and refine systems/applications collection point - where will the data come from to finalize the metric collection report? When will the data be collected? Why is that data important? o Analyze the data/metrics to provide value to the organization and provide a feedback quality mechanism This lists the metric characteristics that delineate boundaries between metric categories - Correct Answers ✅Metric taxonomy CIPM QUESTION & ANSWERS 2024 Metric taxonomies provide what categories? - Correct Answers ✅Objective/Subjective, Quantitative/Qualitative, IT Metrics/Quantitative Measurement, Static/Dynamic, Absolute/Relative, Direct/Indirect Objective metrics are more desirable than what type? - Correct Answers ✅Subjective These measurements typically map to best practices - Correct Answers ✅Qualitative measurements These type of measurements use data recorded within a numerical- mathematical fashion - Correct Answers ✅Quantitative measurements Per recent industry surveys, Chief Information Security Officers seem to prefer which type of measurements? - Correct Answers ✅Qualitative measurements This type of metric evolves with time - Correct Answers ✅Dynamic measurements The distinction between direct and indirect metrics is based on what? - Correct Answers ✅The way a metric is measured CIPM QUESTION & ANSWERS 2024 Size is an example of what type of metric - Correct Answers ✅Direct Quality or complexity can only be measured how? - Correct Answers ✅Indirectly by extrapolation from other measured factors The privacy professional must guard against improper conclusions such as these - Correct Answers ✅Faulty Assumptions, Selective Use, Well- chosen Average, Semi-attachment, Biased Sample, Intentional Deceit, Massaging the Numbers, Overgeneralization This conclusion is based on the occurrence of concurrent events without substantive evidence correlating the events - Correct Answers ✅Faulty Assumptions This is a specific subset of information is extrapolated from the larger data set, which leads to invalid/incorrect conclusions. - Correct Answers ✅Selective Use Many times the mean is used for a metric, but it is sometimes more appropriate to use the median or mode rather than the true mean/average - Correct Answers ✅Well-chosen Average When an individual is unable to provide their point, this may result with the exclusion of elements of a measurement when conveying results - Correct Answers ✅Semi-attachment CIPM QUESTION & ANSWERS 2024 As it relates to ROI metrics, the first step is to identify and characterize the ROI metric to address what? - Correct Answers ✅The specific risk that control or feature is supposed to mitigate As it relates to ROI metrics, the second step is to define what - Correct Answers ✅the value of the asset This is the ability to rapidly adapt and respond to business disruptions and to maintain continuous business operations - Correct Answers ✅Business Resiliency The privacy professional or organization should include in the privacy budget the costs to generate what? - Correct Answers ✅metrics The most time consuming task of a privacy professional was of a strategic nature, which was what? - Correct Answers ✅advising the organization on privacy issues What are the phases of the privacy operational life cycle - Correct Answers ✅o Assess (measure) o Protect (improve) o Sustain (evaluate) o Respond (support) CIPM QUESTION & ANSWERS 2024 What are the PMM maturity levels? - Correct Answers ✅Ad hoc, Repeatable, Defined, Managed, Optimized This PMM maturity level indicates procedures or processes are generally informal, incomplete, and inconsistently applied - Correct Answers ✅Ad hoc This PMM maturity level indicates procedures or processes exist; however, they are not fully documented and do not cover all relevant aspects - Correct Answers ✅Repeatable This PMM maturity level indicates procedures or processes are fully documented and implemented and cover all relevant aspects - Correct Answers ✅Defined This PMM maturity level indicates that reviews are conducted to assess the effectiveness of the controls in place - Correct Answers ✅Managed This PMM maturity level indicates that regular review and feedback is used to ensure continuous improvement towards optimization of the given process - Correct Answers ✅Optimized CIPM QUESTION & ANSWERS 2024 What are the seven foundational principles of PbD? - Correct Answers ✅Proactive not Reactive-Preventative not Remedial; Privacy as the Default Setting; Privacy Embedded into Design; Full Functionality- Positive Sum not Zero-sum; End-to-End Security-Full Life Cycle Protection; Visibility and Transparency; Respect for User Privacy This ensures that privacy and security controls and aligned with an organization's tolerance for risk and its compliance with regulations and commitment to building a sustainable privacy-minded culture - Correct Answers ✅PbD paradigm One tool used to determine whether a PIA should be conducted is called what? - Correct Answers ✅Privacy Threshold Analysis (PTA) These type of assessments further assist the privacy professional in the Protect phase - Correct Answers ✅PIA, risk assessments, security assessments This is a policy-based approach to manage the flow of information through a life cycle from creation to final disposition - Correct Answers ✅DLM/ILM Main drivers of DLM/ILM - Correct Answers ✅1. Enterprise data growth 2. Growth in unstructured data CIPM QUESTION & ANSWERS 2024 This group's role during a data breach can be to work with management and PR teams to establish and maintain a positive, consistent message, during both the crisis and the post-breach notifications - Correct Answers ✅Marketing Because of their unique association with customers and the bond of trust built carefully over time, this group is often asked to notify key accounts when their data has been breached - Correct Answers ✅BD When a data breach occurs, these stakeholders quickly assume their position on the front lines, preparing for the response to potential media inquiries and coordinating internal and external status updates - Correct Answers ✅Communications and PR After a breach occurs, the primary role for this stakeholder is to provide members with timely updates and instructions. - Correct Answers ✅Union Leadership One of the first and arguably most critical steps taken by the top executive is to what? - Correct Answers ✅Promptly allocate funds and manpower needed to resolve the breach. This plan is typically drafted and maintained by key stakeholders, spelling out departmental responsibilities and actions teams must take before, during, and after a data breach - Correct Answers ✅Business Continuity Plan (BCP) CIPM QUESTION & ANSWERS 2024 In a 2011 survey of 400 IT executives, one-fifth indicated these events had made business continuity planning a much higher priority in recent years? - Correct Answers ✅Natural disasters, security and terrorist threats This is a structured readiness testing activity that simulates an emergency situation in an informal, stress-free setting - Correct Answers ✅Table top exercise Generally speaking, this may be described as any potential or actual compromise of personal information in a form that facilitates intentional or unintentional access by unauthorized third parties - Correct Answers ✅Privacy incident A 2012 study revealed what groups were most often the cause for privacy incidents? - Correct Answers ✅Insiders and third parties This is the internal process of employees alerting supervisors about a security-related incident, who in turn report the details to a predefined list of experts - Correct Answers ✅Escalation This is the process of informing affected individuals that their personal data has been breached - Correct Answers ✅Notification CIPM QUESTION & ANSWERS 2024 Assuming privacy incident notification is required, organizations generally have how long to notify the affected individuals - Correct Answers ✅60 days This is one method enforcing security and accountability in how personal data is handled by third parties - Correct Answers ✅Binding contractual obligations and reporting requirements This activity triggers the pre-notification process - Correct Answers ✅Once breach investigators conclude that an actual compromise of sensitive information has occurred Generally, most well-conceived incident response plans account for and/or include which elements? - Correct Answers ✅Key stakeholders, Execution timeline, Progress reporting and Response evaluation and modifications Common reporting intervals in incident response plans include what? - Correct Answers ✅Hourly, daily, weekly, monthly Reporting resources can be found with the technical and business characteristics of an organization that include - Correct Answers ✅People, Processes, Technology