Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP/US 1.0 - IAPP > Ch. 4: Principles of Information Management > Flashcards

Ch. 4: Principles of Information Management Flashcards

1
Q

Roles of privacy professional

A

1) Alert org to varying perspectives about privacy, risk and compliance. Can be divergent.
2) help org manage risks from processing, consistent with org’s mission, growth, profitability, and other goals.
3) Identify where compliance difficult in practice,
4) Design policies to close gaps between policies and operations.
5) Develop privacy notices and privacy program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Risks of Using PI Improperly

A
  1. Legal risks - laws, contracts, committments.
  2. Reputational risks -
  3. Operational risks - administratively efficient privacy program, so as not to be too heavy handed and inhibit beneficial uses.
  4. Investment risks - ROR on investments in information, IT and processing.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

4 Basic Steps for Information Management

A
  1. Discover - identify issues, self-assessment, determine practices.
  2. Build - Procedure development and verification, full implementation.
  3. Communicate - Document, train/educate
  4. Evolve - affirmation, monitoring/enforcement, adaptation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Phase 1 - Discover

A
  • Applicable laws?
  • Risk tolerance?
  • Competition’s approach?
  • Business partners approach?

From these questions, develop policy goals as foundation.

Get broad participation across org.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Phase 2 - Build

A
  • Determine how to meet policy goals by facilitating and restricting data flows.
  • Close coordination across org.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Phase 3 - Communicate

A
  • Train individuals who need to know it.
  • Assign accountability.
  • Broader, high level communication to senior leaders and externally
  • Written policies, notice.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Phase 4 - Evolve

A
  • Process for review and update

- Enforce it as well (TL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data Inventory

A
  • Customer data and employee data
  • Document data flows and location, means of sharing and with whom and why.
  • Review and update periodically.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Data Classification

A
  • levels of sensitivity
  • clearances of who can handle.
  • baseline level of protection.
  • data segregation as necessary/appropriate.
  • Helps org in compliance audits, respond to discovery requests, and use storage in cost-effective manner.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Determining Data Accountability

A
  • Where, how and for what length of time is the data stored?
  • How sensitive is the information? Confidential, proprietary, sensitive, restricted, and public are common categories.
  • Should the info be encrypted?
  • Will info be transferred to or from other countries and if so, how?
  • Who determines the rules that apply to the information?
  • How is the information to be processed, and how will these processes be maintained?
  • Is the use of such data dependent upon other systems?

-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Communication of Privacy Notice

A 
- Make accessible online.
Make accessible in place of business.
- Provide updates and revisions.
- Ensure appropriate personnel are knowledgeable about the policy (like customer service reps).
-
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Privacy Laws Requiring Opt-In Consent, and Circumstances Where Opt-In is Appropriate

A

1) COPPA - consent of parent before collecting PI of children under 13
2) HIPAA - consent before PHI disclosed to 3rd parties, subject to exceptions.
3) FCRA - consent before consumer’s credit report provided to employer, lender or other authorized recipient.

FTC believes opt-in consent should ocurr before PI collected under one privacy notice is processed under a materially changed privacy notice.

Industry segments may require double opt-in - where opt in and then confirm (email marketing, eg).

  • Opt-in preferred as best practice for geo-location data
  • GDPR requires opt-in for marketing to occur.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

No choice / no option cases

A
  • Implied authority to process PI in some cases.
  • Online order - shared with shipping company, CC processor, and fulfillment.
  • Internal operations, such as improving services offered, fraud prevention, legal compliance, and first party marketing.
  • 2012 FTC report noted no consent if processing consistent with context of transaction, company’s relationship with consumer, or required by or specifically authorized by law.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Opt-Out

A
  • GLBA requires opt-out before transferring PI of customer of fin. institution to an unafilliated 3rd party for 3rd party’s own use.
  • Video Privacy Protection Act requires opt-out before covered movie / other rental data provided to 3rd party.
  • CAN-SPAM requires email marketers to provide an opt-o eut.
  • Do Not Call rules provide opt-out of telemarketing calls, both in general and company by company.
  • Data & Marketing Association operates opt-out system for consumers not wanting commercial mail sent to their home.
  • Ditto for online advertising orgs like The Network Advertising Initiative, TrustArc, and Digital Advertising Alliance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Managing User Preferences - Challenges

A
  1. Scope of an opt-out or opt-in. By channel (email vs. phone, eg),
  2. Mechanism for providing user preference. Generally, channel for marketing is required channel for user preference (don’t require you to mail in your email preferences).
  3. Linking. Good practice is to implement opt-out or other user preference across channels and platforms.
  4. Time period for implementing user prefs. - How soon become operational. CAN-SPAM and Telemarketing Sales Rules mandate specific time periods.
  5. 3rd party vendors - these should honor the customer preferences.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Customer Access and Redress

A

Refer to APEC access/redress principles from Chapter 1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Vendor Contracts

A
  1. Confidentiality provision
  2. No further use of shared information - only for purposes contracted.
  3. Use of subs - flow down obligations.
  4. Requirement to notify and disclose breach
  5. Infosec provisions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Vendor Due Diligence Standards

A
  1. Reputation
  2. Financial condition and insurance.
  3. Info sec controls.
  4. Point of transfer - secure transfer.
  5. Disposal of info.
    6 Employee training and user awareness.
  6. Vendor incident response.
  7. Audit rights.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Key New Provisions in GDPR

A

(1) notification of security breaches,
(2) new requirements for processors (contractors who act on behalf of data controllers),
(3) designation of data protection officers,
(4) accountability obligations,
(5) rules for international transfers and
(6) sanctions of up to four percent of worldwide revenues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What types of risks should be considered when using PI ?

A
  1. Legal Risks
  2. Reputation Risks
  3. Operational Risks
  4. Investment Risks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What do the Legal Risks stem from?

A

Failure to comply with applicable law, contractual commitments, privacy promises, and industry standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What do the Reputational Risks stem from?

A

Legal enforcement and if they announce privacy policies but do not carry them out. .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What do the Operational Risks stem from?

A

Administrative efficiency and cost effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What do the Investment Risks stem from?

A

The ability to receive an appropriate return on it investments in information, Information technology, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 4 basic steps for Information Management?

A
  1. Discover
  2. Build
  3. Communicate
  4. Evolve
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What should practices and controls that organizations use for managing PI address?

A
  1. Data Inventory
  2. Data Classification
  3. Documenting Data Flows
  4. Determining Data Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does Data Inventory involve?

A

An inventory of the PI (employee and customer) that the organization collects, stores, uses, or discloses. It should document data location and flow as well as evaluate how, when, and with whom the organization shares such information - and the means for data transfer used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does Data Classification involve?

A

Classifying data according to its level of sensitivity. It should define the clearance of individuals who can access or handle the data, as well as the baseline level of protection that is appropriate for that data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does Documenting Data Flows involve?

A

The mapping and documenting of the systems, applications, and processes handling data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What does Determining Data Accountability involve?

A

The responsibility to assure compliance with privacy laws and policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What do Privacy Policies do?

A

They inform relevant employees about how PI must be handled, and in some cases are made public in the form of a privacy notice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

When does one Privacy Policy make sense?

A

When an organization has a consistent set of values and practices for all its operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

When do multiple Privacy Policies make sense?

A

When a company that has well-defined divisions of lines of business, especially if each division uses customer data in very different ways, does not typically, share PI with other divisions and is perceived in the marketplace as a different business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What should a company do if it revises its Privacy Policy?

A
  1. Announce the change to employees
  2. Announce the change to current and former customers
  3. Per the FTC, obtain express affirmative consent (opt-in) before making material retroactive changes to privacy representations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What methods may a company communicate its Privacy Notice?

A
  1. Make the notice accessible in places of business
  2. Make the notice accessible online
  3. Provide updates and revisions
  4. Ensure that the appropriate personnel are knowledgeable about the policy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is an opt-in?

A

One of two central concepts of choice. It means an individual makes an active affirmative indication of choice; i.e., checking a box signaling a desire to share his or her information with third parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What legal bodies require opt-ins?

A

COPPA, HIPPA, FCRA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is an opt-out?

A

One of two central concepts of choice. It means an individual’s lack of action implies that a choice has been made; i.e., unless an individual checks or unchecks a box, their information will be shared with third parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is no consumer choice or no option?

A

When companies use consumer data for practices that are consistent with the context of the transaction, consistent with the company’s relationship with the consumer, or as required or specifically authorized by law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are some management challenges of user preferences?

A
  1. The scope of the opt-out or other user preference can vary.
  2. The mechanism for providing an opt-out or other user preference can vary.
    3, Linking of a user’s interactions.
  3. The time period for implementing user preferences.
  4. Third party vendors often process PI on behalf of the company.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What laws give consumers the right to access the PI held about them?

A
  1. FCRA
  2. HIPAA
  3. Statements on fair information practices - OECD Guidelines, APEC Principles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What precautions should be included in vendor contracts?

A
  1. Confidentiality provision
  2. No further use of shared information.
  3. Use of subcontractors.
  4. Requirement to notify and to disclose breach
  5. Information security provisions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What vender due diligence standards should a company consider using?

A
  1. Reputation.
  2. Financial Condition and insurance
  3. Information Security Controls
  4. Point of Transfer
  5. Disposal of information
  6. Employee Training and User Awareness
  7. Vendor incident response
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which of the following are the three stages for implementing and managing information systems?

A. selection
B. control
C. Compliance
D. Evaluation

A

A
B
D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Regarding controls on the information, what should organizations focus on?

A
  • Information security

* Information quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Regarding controls on the information, what should organizations do with respect to information security?

A

Organizations should use reasonable administrative, technical and physical safeguards to protect personal information against unauthorized access, use, disclosure, modification and destruction.

47
Q

Regarding controls on the information, what should organizations do with respect to information quality?

A

Organizations should maintain accurate, complete and relevant personal information for the purposes identified in the notice.

48
Q

Organizations should address the life cycle of information, including what elements?

A

Collection
Use and retention
Disclosure.

49
Q

Building a privacy strategy may mean changing the ______ and ______ of an entire organization.

A

mindse

perspective

50
Q

________ in an organization has a role to play in protecting the personal information an organization collects, uses and discloses.

A

Everyone

51
Q

Management needs to :

A

approve funding to resource and equip the privacy team,fund important privacy-enhancing resources and technologies,support privacy initiatives such as training and awareness, andhold employees accountable for following privacy policies and procedures.

52
Q

Sales personnel must:

A

secure business contact data and respect the choices of these individuals.

53
Q

Developers and engineers must

A

1) incorporate effective security controls,
2) build safe websites, and
3) create solutions that require the collection or use of only the data necessary to accomplish the purpose.

54
Q

An organization experienced a breach of credit card data, how should it respond?

A

notify affected card brands immediately. They are required to notify all affected credit card brands

55
Q

An organization experienced a breach of credit card data, how should it respond?

A

Notify affected credit card brands immediately (it’s a requirement)

56
Q

When should executives be made aware of changes in applicable cybersecurity laws?

A

during a routine monthly risk update

57
Q

The classification of an incident is an indication of what 3 things?

A

data, application or system involved (incident classification can also be tied to the location)

58
Q

A CISO noticed that dwell time metrics aren’t improving, what should be done?

A

improve incident detection capabilities

59
Q

Does an executive level security council include allocating security budgets to business units?

A

no.

It’s a good way to get executives talking about cyber risk and business risk, and making risk decisions

60
Q

In a quantitative risk analysis, how is risk expressed in terms of the partial loss of functionality of an asset?

A

Exposure Factor (EF)

61
Q

A risk assessment of an organization’s SDLC might compel the organization to do what?

A

Introduce secure coding standards

not update coding standards, because that may not address security specifically

62
Q

What elements should be included in a business case document template?

A 
Current State
Desired End State
Requirements
Approach
Plan
63
Q

A basic security incident response has how many steps, and what are they?

A

8

detect
initiate
evaluate
eradicate
recovery
remediate
closure
review
64
Q

True or False?

In addition to documenting roles and responsibilities, an incident response program should include detailed procedures for responding to common incidents

A

True

65
Q

What activity helps ensure a security program is aligned with a security strategy?

A

Periodic Management Review

66
Q

What is the best indicator of effectiveness?

A

The trend line for the number of critical and high vulnerabilities found in application penetration tests

67
Q

How does the percentage of effective controls show value (how is it a value delivery metric?)

A

By illustrating how well the security program is ensuring control effectiveness

68
Q

Who is included in a directory of parties to notify in an emergency?

A 
regulators
offsite media storage companies 
contract personnel services
suppliers
law enforcement
insurance company agents
69
Q

What is the problem with the following control statement, “Endpoints are protected from malware with McAfee Antivirus”

A

It’s overly specific.

If they switched to Symantec, they would technically be out of compliance

Note that it is also unambiguous, but that’s not the best answer.

70
Q

How will a security manager determine the actions needed to achieve the desired end state for a new security program?

A

Perform a gap analysis

That will help understand the present state and the actions needed to move from the present to the desired state

71
Q

How can a CISO best understand the organization’s risk tolerance?

A

Interview board members and senior executives.

Examining the risk ledger or other artifacts or capabilities may not accurately reflect the organization’s current risk tolerance.

72
Q

A control’s effectiveness can be tested with a review. True or False?

A

False.

A self-assessment, internal or external audit are all ok but a review is less rigorous

73
Q

What does this describe?

A document describing the need for a mobile device management program that describes required resources, benefits, and a high-level plan

A

Business case

not a proposal

74
Q

If an organization has a nonstandard IT governance framework, should the security governance framework be built to resemble it?

A

Yes

An organization’s security governance framework should be similar to other frameworks, especially that of IT

(don’t build it around industry standards)

75
Q

If an auditor examines a business activity for which there is no control and scores the control as ineffective, what’s the best response?

A

To treat the activity as though a control should exist - develop a control and ensure it’s effective

76
Q

Can organizations ever opt out of PCI DSS controls?

A

no

77
Q

Compare leading vs trailing indicators

A

1) trailing indicators show past events

2) leading indicators show future risks

78
Q

Is it common to require project managers to earn security certifications?

A

no

Security related improvements to project management would not include getting the PM certified in security

79
Q

Is a control self-assessment the most effective way to determine compliance with internal policies?

A

yes

80
Q

What does a qualified opinion mean?

A

That the audit has failed in one or more of its high-level control objectives. This is cause for concern and further inquiry

81
Q

What’s the next step after a security policy has been reviewed and update?

A

Publish it and inform workers where to find it

not require them to sign it
not include changes in security awareness training
not simply publishing it

82
Q

What’s the purpose of a security addendum in a legal contract?

A

To specific security-related terms and conditions

83
Q

document marking

A

“Restricted. For Limited Distribution”

84
Q

procedure

A

1) describes step by step instructions to perform a task

2) it can be part of a process

85
Q

What information will an external pen tester need to plan a pen test of an organization’s externally facing applications?

A

URL’s (not IP ranges)
time of day to test
emergency contact information

86
Q

An auditor examines an activity for which no control exists and scores it as ineffective. What is the best response?

A

Develop a written control and ensure it’s effective

not perform a risk analysis to determine if a control should be developed

87
Q

A developer informs the CISO that the organization is out of compliance with PCI-DSS. How should the CISO proceed?

A

Create an entry in the risk ledger and look into the matter.

not conduct an investigation, it’s good but not the best initial reaction

88
Q

Document that describes the need for a business capability, including costs and benefits is a what?

A

business case

89
Q

file integrity monitoring

A

Periodically scan file systems and report on any changes that occur.

Changes may be due to maintenance but also indicate compromise

90
Q

file activity monitoring

A

Monitor directories and files to detect unusual activities that may indicate compromise.

do not use this for help with making sure servers are consistently configured

91
Q

RACI Chart

A

Responsible
Accountable
Consulted
Informed

Assigns levels of responsibility to individuals and groups.

Helps personnel determine roles for various business activities

92
Q

How often should incident escalation procedures be updated?

A

Once per year, or when executive personnel changes

93
Q

If a risk register has grown too large, what is the best remedy?

A

Implement a GRC (Governance, Risk, Compliance) platform with management module.

Automating through a risk management module in a GRC platform is best.

94
Q

After a security policy has been reviewed and updated, what are the next steps?

A

Publish and inform workers

95
Q

What’s the best way to introduce security into the hiring process?

A

perform background checks, use NDA’s, verify licenses and certifications, verify prior employment

Not require candidates to complete security awareness training

96
Q

What’s special about leading indicators?

A

they’re potential indicators of future attacks / events

ie a percentage of critical servers that are not patched in 30 days

97
Q

An auditor examines a business activity for which no written control exists and scores it as ineffective. What’s the best response?

A

Develop a written control and ensure it is effective. Generally, if an auditor examines a business activity as though a control exists, but does not, the organization should formally develop the control.

Not - perform risk analysis to determine whether a control should be developed

98
Q

Process (Process Document)

A

Document that describes the overall activities to take place on a particular activity

99
Q

Process (Process Document)

A

Document that describes the overall activities to take place on a particular activity

Describes all of the actions to take place regarding vulnerability management

100
Q

The most complete business case for security solutions is one that…

A

includes appropriate justification

101
Q

Which is the most effective technique to determine compliance with internal policies?

control self-assessment
vulnerability assessment
risk assessment
threat assessment

A

control self-assessment

102
Q

one disadvantage of preventive controls compared to detective controls?

preventive take longer to certify
preventive requires more training
detective are easier to implement
preventive sometimes prevent desired outcomes

A

preventive controls sometimes prevent desired outcomes.

for example, blocking legitimate email as spam, or an IPS that prevents legitimate downloads

103
Q

business record consisting of identified security issues is a?

risk assessment
risk ledger
vulnerability assessment
penetration test

A

Risk Ledger

not a risk assessment because that only identifies some but not all issues

104
Q

In designing and administering a privacy program, an organization should consider and balance four types of risks.

A

1) Legal risks.
2) Reputational risks.
3) Operational risks.
4) Investment Risks

105
Q

Investment risks.

A

The organization must be able to receive an appropriate return on its investments in information, information technology and information-processing programs in light of evolving privacy regulations, enforcement and expectations.”

106
Q

Operational risks.

A

The organization must ensure that its privacy program is administratively efficient. If a privacy program is too heavy-handed, it may interfere with relationships and inhibit uses of PI that benefit the organization and its customers, such as for personalization or risk management.

107
Q

Reputational risks

A

The organization can face reputational harm if it announces privacy policies but does not carry them out; 9 it may also face enforcement actions—particularly from the Federal Trade Commission (FTC). An organization should seek to protect its reputation as a trusted institution with respected brands.

108
Q

Legal risks.

A

The organization must comply with applicable state, federal and international laws regarding its use of information or potentially face litigation or regulatory sanctions such as consent decrees, which may last for many years. The company must also comply with its contractual commitments, privacy promises and commitments to follow industry standards, such as the Payment Card Institute Data Security Standard (PCI DSS).

109
Q

Decades of opinion surveys show that people can be categorized in three groups:

A

1) the “privacy fundamentalists” (people with a strong desire to protect privacy), 2) the “privacy unconcerned” (people with low worries about privacy), and
3) the “privacy pragmatists” (people whose concern about privacy varies with context and who are willing to give up some privacy in exchange for benefits).

110
Q

True/ False

In most organizations, information management requires a combination of skills, including legal, marketing, sales, human resources, public and government relations, and information technology. In large organizations, privacy professionals may be part of a team that draws on a mix of these skill sets.”

A

True

111
Q

Privacy professionals help their organizations by:

A

a) manage a range of risks that can arise from processing personal information, and do so in a manner consistent with meeting the organization’s growth, profitability and other goals.
b) to identify areas where compliance is difficult in practice, and design policies to close gaps between stated policies and actual operations.”

112
Q

True/ False

One role for privacy professionals is to alert their organizations to these often-divergent perspectives.

A

True

113
Q

It is now increasingly common for companies to develop an information management program that seeks

A

a holistic approach to the risks and benefits of processing PI.

114
Q

The program, in turn, helps create policies and practices for important parts of the organization’s activities. Common activities for such policies include:

A

1) maintaining preference lists for direct marketing,
2) developing appropriate security for human resources data,
3) executing proper contracts to authorize international data flows and
4) publishing online privacy notices when data is collected.”

CIPP/US 1.0 - IAPP (39 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions