M1 - National Institute of Standards and Tech Frameworks Flashcards
Identify
What are the company’s privacy risks related to data processing activities?
Categories:
-Inventory and Mapping
-Business Environment
-Risk Assessment
-Data Processing Ecosystem Risk
Govern
What is the best governance structure for privacy risks related to the company’s data processing activities?
Categories:
-Governance Policies, processes and procedures
-Risk management strategy
-Awareness and training
-Monitoring review
Control
What is the best management structure for privacy risks related to data processing activities?
Categories:
-Data processing policies, processes and procedures
-Data processing management
-Disassociated processing
Communicate
How should the organization drive dialogue around privacy risks related to data processing activities?
Categories:
-Communication policies, processes and procedures
-Data processing awareness
Protect
What are the safeguards that should be in place around privacy risks related to data processing activities?
Categories:
-Data protections policies, processes and procedures
-Identity management, authentication and access control
-Data security
-Maintenance
-Protective technology
Detect
How should the organization detect data privacy risks and events?
Categories:
-Anomalies and events
-Security Continuous Monitoring
-Detection Processes
Respond
How should the organization respond to data privacy events?
Categories:
-Response planning
-Communications
-Analysis
-Mitigation
-Improvements
Recover
How should the organization respond to data privacy events?
Categories:
-Recovery Planning
-Improvements
-Communications
Tier 1
Partial
Risk Management Process: RM is ad hoc and reactive. IS efforts is not prioritized.
Integration: Incident management is ad hoc and not integrated
External Participation: Corporate cybersecurity is isolated and the org doesn’t evaluate external risks
Tier 2
Risk-Informed
Risk Management Process: CS prioritization is based on org risk. Management approves CS efforts; however, CS may be isolated from org processes
Integration: Awareness, but no integration
External Participation: There is awareness of how env security risks impact the organization, but inconsistent actions are taken to respond to this risks
Tier 3
Repeatable
Risk Management Process: Org utilizes CS in planning and has enshrined CS practices in formal, documented policies
Integration: CS is integrated into planning and regularly communicated among senior leadership
External Participation: The org collaborates with and contributes to security community at large. It also has governance structures internally to manage cyber risk
Tier 4
Adaptive
Risk Management Process: Org CS is based on iterative improvement based on internal and external cyber incidents and is responsive to evolving threats
Integration: Managing CS is and org-wide affair. Cyber risk is prioritized heavily
External participation: The org participates in external information.
Explain the difference between a Current Profile and a Target Profile
Current Profile: is the Current state of org risk management
Target Profile: desired future state of org risk management
The differences between the current state and future state are identified in a gap analysis
