Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP/M > CIPM > Flashcards

CIPM Flashcards

Exam preparation

1
Q

What 2 things does DLM (Data Lifecycle Management) Establish?

A
  1. Data Handling Policy
  2. Employee Roles and Responsibilities.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q
  1. Whats the manner of how breaches occur?
  2. What percent does each account for?
A
  1. Negligent Insider 34%
  2. Outsourcing data to a third party 19%
  3. Malicious insider 16%
  4. Systems “glitch” 11%
  5. Cyber attack 7%
  6. Failure to shred documents 6%
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the three types of audits?

A
  • 1st Party - Internal
  • 2nd Party - Supplier / Contractor
  • 3rd Party - External.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a business case?

A

Defines a business need and describes a way to meet that goal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How does a complaint handling procedure differ from a privacy question procedure?

A

it is more formal (required by some data protection laws) and should include: -

  • Centralized intake
  • Escalation process
  • Mgmt from intake to resolution
  • Flexibility to:-
    • Involve stakeholders as needed
    • Function between teams for privacy complaints embedded in ethics complaints.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What should a company do with regard to letter-drops (notifications by mail)?

A

Front load the work:

  • Establish Secure data channel
  • Create literature in advance
  • Obtain content approvals
  • Send logo & signature files to printer before andincident occurs
  • Supply return address to printer.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

With regard to improper use of metrics what is are: -

  • Biased Sample
  • Intentional deceit
A
  • Measurement excluding relevant elements of data, cherry picking to get desired result.
  • As the name suggests the intent is to deceive.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What’s the role of Union leadership in breach planning and response?

A

Planning - represent union members interests, plan to speak on behalf of members

Response - Work with other members of the response team re communication channels in their control for example - Union Social Media, Web, Intranet etc.

Contact workers on member rolls, if appropriate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

With regard to data integrity whats human error versus systemic error?

A

Human: - Miskeyed input

Systemic: - Database fields mismatched.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the requirements of PCI-DSS?

A
  • Firewall
    • Default Settings allowed
    • Protect cardholder data
    • Encrypt transmission
    • Anti Virus
    • Secure system and apps.
  • Access control
    • Unique ID’s
    • Physical Access restricted
    • Monitor and track access
    • Test security of system
    • Info sec policy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the presidents or CEOs role in breach planning and response?

A

Planning -

  • Oversee breach control
  • Bears responsibility in a breach incident.

Response -

  • Set tone for company & employees
  • Allocates human and financial resources
  • Makes public statement & coordinates PR.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why should an organization or privacy professional use a privacy framework? (4 reasons)

A
  • Reduce Risk
  • Avoid data loss
  • Sustain organization market value and reputation
  • Comply with laws, regulations and standards.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What’s a privacy workshop?

A

Meeting where privacy professional, stakeholders are informed about legal & market expectations on privacy, answering questions, setting the baseline for privacy knowledge.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the four elements of a privacy response plan?

A
  • Key Stakeholders assemble those responsible for plans design & implementation.
  • Execution timeline - Plans execution schedule.
  • Progress reporting - Determine who will need to know what and facilitate it.
  • Response evaluation - Lessons learned from incidents documented and incorporated.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How should a company recover from the bad press or reputational damage following a breach?

A

Marketing internal or external consultants and public relations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are operational privacy? practices

A
  • Standard Operating Instructions & related training for specific contents involving handling personal data.
  • Personal data collection use, retention & disposal.
  • Data handling e.g encryption
  • Reporting incidents
  • Department specific handling procedures.
17
Q

Whats an audit and why conduct one?

A

Systemic & independent examination to determine whether the personal data processing adhering to data policy & procedures: -

  • Demonstrates compliance
  • Shows GAPS
  • Determine whether priv controld correctly managed
  • Demonstrate the functioning of privacy programs et alia.
18
Q

What does a DLP scanning tool do?

A

Looks through unstructured or structured files to identify personal data and assist in setting security controls.

19
Q

What’s APEC and how is it relevant to privacy?

A

Aisa Pacific Economic Cooperation

Has a framework to enable safe data transfers meant to benefit consumers business & govt.

20
Q

What is the ISTPA?

A

The international Security Trust and Privacy Alliance

is an organization focused on creating actionable frameworks for a business implementing data protection policies.

21
Q

What are the metric taxonomies and where do they come from?

A

NIST IR 7564

  • Objective/Subjective
  • Quantitative / Qualitative
  • IT Metrics/ Quantitative measurement
  • Static/Dynamic
  • Absolute / Relative (absolute not depnedant on others)
  • Direct/Indirect (size=direct,complexity=indirect)
22
Q

What framework does/did the U.S publish in 2012.

A

Consumer bill of rights White House publication.

23
Q

What’s the AICPA/CICA framework?

What application do they use?

A
  1. GAPP Generally accepted privacy principles.
  2. Webtrust applications to have accountants certified to conduct priv evaluations like Canadian PIA based on multinational privacy laws,
24
Q

What should an organisation do to limit liabilities for 3rd party vendors?

A
  1. Vendor Vetting / due diligence
  2. Contract provisions to address privacy concerns.
  3. Monitoring & auditing once vendor is engaged.
25
Q

What are the elements of the metric lifecycle?

A
  • IDENTIFY intended audience
  • DEFINE data sources, data owners, data access
  • SELECT the actual metrics based on audience and sources.
  • COLLECT the data, how who, when, where, what, why.
  • ANALYZE metrics/data ROI.
26
Q

What are the following self-regulatory standards.

  • PCI DSS
  • NAI
  • DMA
  • CARU
A
  1. Payment Card Industry Data Sec Standard
  2. Network Advertising Initiative (Online ads)
  3. Digital Marketing Association (interactive marketing)
  4. Childrens Advertising Review Unit ads to under 12s.
27
Q

Whats Australias Information Privacy law and who enforces it?

A

Australian Privacy Principles (APP)

28
Q

What 2 things should employees be taught regarding breaches?

A
  1. How to detect
  2. How to report and escalate.
29
Q
A

CIPP/M (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions