Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPM > CIPM BOK Outline > Flashcards

CIPM BOK Outline Flashcards

1
Q

Privacy Program Governance - 4 main subcategories

A
  1. Organizational Level
  2. Develop the Privacy Program Framework
  3. Implement the Privacy Program Framework
  4. Metrics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Governance: Organizational Level - 4 main subcategories

A
  1. Create a company vision
  2. Establish Data Governance Model
  3. Establish a privacy program
  4. Structure the Privacy Team
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Create a company vision

Gov., Org level

A
  1. Acquire knowledge on privacy approaches
  2. Evaluate the intended objective
  3. Gain executive sponsor approval for this vision
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Establish Data Governance Model

Gov., Org level

A
  1. Centralized
  2. Distributed
  3. Hybrid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Establish a Privacy Program

Gov., Org Level

A
  1. Define program scope and charter
  2. Identify the source, types, and uses of personal information within the organization and the applicable laws
  3. Develop a Privacy Strategy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Privacy Strategy

Gov., Org level, privacy program

A
  1. Business alignment– finalize the operational business case for privacy, identify stakeholders, leverage key functions, create a process for interfacing within organization, align organizational culture and privacy/data protection objectives, and obtain funding/budget for privacy and the privacy team
  2. Develop a data governance strategy for personal information (collection, authorized use, access, and destruction)
  3. Plan inquiry/complaint handling procedures (customers, regulators, etc)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Structure the Privacy team

Gov., Org level

A
  1. Establish the organizational model, responsibilities, and reporting structure appropriate to the size of the organization
  2. Designate a point of contact for privacy issues
  3. Establish/endorse the measurement of professional competency
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Large Organization Structure

A
  1. Chief Privacy Officer
  2. Privacy Manager
  3. Privacy Analysts
  4. Business line privacy leaders
  5. “First Responders”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Small Organization Structure

A

Sole Data Protection Officer (DPO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Privacy Program Development

Gov

A
  1. Develop organizational privacy policies, standards, and/or guidelines
  2. Define privacy program activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Privacy Program Activities

Gov, Program Framework

A
  1. Education and Awareness
  2. Monitoring and responding to the regulatory environment
  3. Internal policy compliance
  4. Data inventories, data flows, and classification
  5. Risk assessments (PIAs, PTAs, etc)
  6. Incident Response and process, including jurisdictional regulations
  7. Remediation
  8. Program assurance, including audits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Privacy Program Implementation

Gov

A
  1. Communicate the framework to internal and external stakeholders
  2. Ensure continuous alignment to applicable laws and regulations to support the development of an organizational privacy program framework
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Ensuring continuous alignment of program

Gov, Program Implementation

A
  1. Understand when national laws and regulations apply (e.g., GDPR, CCPA)
  2. Understand when local laws and regulations apply
  3. Understand penalties for noncompliance with laws and regulations
  4. Understand the scope and authority of oversight agencies (e.g., Data Protection Authorities, Privacy Commissioner, FTC, etc.)
  5. Understand privacy implications of doing business with or basing operations in countries with inadequate, or without, privacy laws
  6. Maintain the ability to manage a global privacy function
  7. Maintain the ability to track multiple jurisdictions for changes in privacy law
  8. Understand international data sharing arrangement agreements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Metrics

Gov

A
  1. Identify intended audience for metrics
  2. Define reporting resources
  3. Define privacy metrics for oversight and governance per audience
  4. Identify systems/application collection points
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Defining Privacy Metrics

Gov., Metrics

A
  1. Compliance metrics (i.e., collection, responses to data subject inquiries, use, retention, disclosure to third parties, incidents- breaches, complaints, inquiries- employees trained, PIA metrics, privacy risk indicators, percent of company functions represented by governance mechanisms)
  2. Trending
  3. Privacy program return on investment
  4. Business resiliency metrics
  5. Privacy program maturity levels
  6. Resource utilization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Privacy Operational Life Cycle

A
  1. Assess your organization
  2. Protect
  3. Sustain
  4. Respond
17
Q

Assess

life cycle

A
  1. Document current baseline of your privacy program
  2. Processors and third-party vendor assessment
  3. Physical assessments
  4. Mergers, acquisitions, and divestitures
  5. Conduct analysis and assessments, as needed or appropriate
18
Q

Current baseline documentation

Life cycle, Assess

A
  1. Education and Awareness
  2. Monitoring and responding to the regulatory environment
  3. Internal policy compliance
  4. Data, systems, and process assessment (map data inventories, flows, and classifications, create “Record of Authority” of systems processing personal information within the organization, map and document data flow in systems and applications, and analyze and classify types and uses of data)
  5. Risk assessments (PIAs, PTAs, etc)
  6. Incident Response
  7. Remediation
  8. Determine desired state and perform gap analysis against an accepted standard or law
  9. Program assurance, including audits
19
Q

Processors and third-party vendor assessment

Life Cycle, Assess

A
  1. Evaluate processors and third-party vendors, insourcing and outsourcing privacy risks, including rules of international data transfer (Privacy and info security policies, access controls, where PI is being held, and who has access to PI)
  2. Understand and leverage the different types of relationships (internal audit, info security, physical security, data protection authority)
  3. Risk assessment (type of data being outsourced, location of data, implications of cloud computing strategies, legal compliance, records of retention, contractual requirements like incident response, and establish minimum standards for safeguarding information
  4. Contractual requirements
  5. Ongoing monitoring and auditing
20
Q

Physical Assessments

Life Cycle, Assess

A

Identify operational risk in:

  1. Data centers and offices
  2. Physical access controls
  3. Document destruction
  4. Media sanitization and disposal (e.g., hard drives, USB/thumb drives)
  5. Device forensics
  6. Device security (e.g., mobile devices, IoT, geo-tracking, imaging/copier hard drive security controls
21
Q

Mergers, Acquisitions, and Divestitures

Life Cycle, Assess

A
  1. Due diligence

2. Risk assessment

22
Q

Conduct analysis and assessments, as needed or appropriate

Life Cycle, Assess

A
  1. PTAs on systems, applications, and processes
  2. PIAs - define the process for conducting, understand the life cycle of a PIA and incorporate PIAs into system, process, product life cycles
23
Q

Protect

Life Cycle

A
  1. Data Life Cycle and governance (creation to deletion)
  2. Info security practices (Access controls for physical and virtual systems, technical security controls, implement appropriate administrative safeguards
  3. Privacy by Design (integrate PbD throughout the system development life cycle & establish privacy gates as part of the system development framework)
24
Q

Sustain

Life Cycle

A
  1. Measure
  2. Align
  3. Audit
  4. Communicate
  5. Monitor
25
Q

Measure

Life cycle, sustain

A
  1. Quantify the costs of technical controls
  2. Manage data retention with respect to the organization’s policies
  3. Define the methods for physical and electronic data destruction
  4. Define roles and responsibilities for managing the sharing and disclosure of data for internal and external use
26
Q

Align

Life cycle, sustain

A

Integrate privacy requirements and representation into functional areas across the organization:

  1. Information security
  2. IT operations and development
  3. Business continuity and disaster recovery planning
  4. Mergers, acquisitions, and divestitures
  5. Human resources
  6. Compliance and ethics
  7. Audit
  8. Marketing/business development
  9. Public relations
  10. Procurement/sourcing
  11. Legal and contracts
  12. Security/emergency services
  13. Finance
  14. Others
27
Q

Audit

Life Cycle, sustain

A
  1. Align program privacy operations to an internal and external compliance audit program (knowledge of audit processes & align to industry standards)
  2. Audit compliance with privacy policies and standards
  3. Audit data integrity and quality and communicate audit findings with stakeholders
  4. Audit information access, modification, and disclosure accounting
28
Q

Communicate

Life cycle, sustain

A
  1. Awareness

2. Targeted employee, management, and contractor training

29
Q

Communicating Awareness

Life cycle, sustain

A
  1. Create awareness of the organization’s privacy program internally and externally
  2. Ensure policy flexibility in order to cooperate legislative/regulatory/market requirements
  3. Develop internal and external communication plans to ingrain organizational accountability
  4. Identify, catalog, and maintain documents requiring updates as privacy requirements change
30
Q

Communicating Training

Life Cycle, Sustain

A

For targeted employee, management, and contractor training:

  1. Privacy policies
  2. Operational privacy practices (e.g., standard operating instructions), such as data creation/usage/retention/disposal, access control, reporting incidents, and key contacts
31
Q

Monitor

Life Cycle, Sustain

A
  1. Environment (e.g., systems, applications) monitoring
  2. Monitor compliance with established privacy policies
  3. Monitor regulatory and legislative changes
  4. Compliance monitoring (e.g., collection, use, and retention) with internal audit, self-regulation, retention strategy, exit strategy
32
Q

Respond

Life Cycle

A
  1. Information Requests

2. Privacy incidents

33
Q

Responding to Information Requests

Life Cycle, Respond

A
  1. Access
  2. Redress
  3. Correction
  4. Managing data integrity
34
Q

Responding to Privacy Incidents

Life Cycle, Respond

A
  1. Legal Compliance
  2. Incident Response Planning
  3. Incident detection
  4. Incident Handling
  5. Follow incident response process to ensure meeting jurisdictional, global, and business requirements
  6. Identify incident reduction techniques
  7. Incident metrics–quantify the cost of a privacy incident
35
Q

Legal Compliance in Incident Response

Life Cycle, Respond

A
  1. Preventing harm
  2. Collection limitations
  3. Accountability
  4. Monitoring and enforcement
36
Q

Incident Response Planning

Life Cycle, Response

A
  1. Understand key roles and responsibilities by Identifying key business stakeholders (info security, legal, audit, human resources, marketing, biz development, communications and PR, and other) & establishing oversight team
  2. Develop a privacy incident response plan
  3. Identify elements of the privacy incident response plan
  4. Integrate privacy incident response into business continuity planning
37
Q

Incident Detection

Life Cycle, Response

A
  1. Define what constitutes a privacy incident
  2. Identify reporting process
  3. Coordinate detection responsibilities with Organization IT, Physical Security, Human resources, Investigation teams, and vendors
38
Q

Incident Handling

Life Cycle, Response

A
  1. Understand key roles and responsibilities

2. Develop a communications plan to notify executive management

39
Q

Incident Response Process

Life Cycle, Response

A
  1. Engage privacy team
  2. Review the facts
  3. Conduct analysis
  4. Determine actions (contain, communicate, etc.)
  5. Execute
  6. Monitor
  7. Review and apply lessons learned

CIPM (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions