CH 10 - Measure, Monitor & Audit Program Performance Flashcards
What is the first step to select relevant metrics?
Identify intended metric audience.
Who makes up the primary metric audience?
Legal and privacy officers, senior leadership, CIO, program managers, system owners, security officers, and other managers.
Who makes up the secondary metric audience?
CFO, training organizations, HR, inspectors general, HIPAA security officials
Who makes up the tertiary metric audience?
External watchdog groups, sponsors, stakeholders.
Metric owner
Responsible for metric throughout the metric life cycle. Should have privacy knowledge, training and experience. Asks why the metric is important and how it fits into business objectives. Monitors performance with the metric. Keeps process documentation up to date for metric.
Trend analysis
Metric to analyze privacy program performance. Ensures data relationships are meaningful and significant (e., time series, cyclical component, irregular component)
ROI
Metric to analyze privacy program performance. Provides quantitative measurement for costs, benefits, strengths and weaknesses of organization’s privacy controls.
Business resiliency
Metric to analyze privacy program performance.
Program maturity
Metric to analyze privacy program performance.
What should an organization consider when determining the value of information assets?
Cost of producing information, value on open market, cost of reproducing if it is lost/damaged/destroyed,
Continuous monitoring
Are you protecting personal information? Following policies, etc? Minimizing consequences? Providing feedback? Demonstrating commitment?
Forms of monitoring
Active scanning tools, audits, dashboards, complaint tracking
Privacy audit
A systematic and independent examination to determine whether activities involving the processing of personal data are carried out in accordance with an organization’s data protection policies and procedures.
Audit planning (auditor selection), audit preparation (schedule, scope), audit, report, and follow-up
Five phases of privacy program audit.
Self assessment - performed by internal employees. self certification does not exempt an organization from fulfilling obligations under laws or regulations.
First party audit
