Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP > Section 1 > Flashcards

Section 1 Flashcards

1
Q

GDPR SPI

A

Data about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person,, health data, data about sex life or orientation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

HHS ways to de-identify data

A

Expert determination (statistician) or safe harbor (removal of 18 types of info)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

GAPP Principles

A

Management, Notice, Choice and Consent, Collection, Use/Retention/Disposal, Access, Disclosure, Security for Privacy, Quality, & Monitoring + Enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ISO 27701

A

It covers best practices for implementing privacy controls. Annex F provides advice on applying the privacy standard in an organization that already uses the information security standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the data that must be removed from a data set for the HHS safe harbor in de-identification?

A

names, geographic dvisions and ZIP codes containing fewer than 20K, month and day of a person’s birth/death/hospital admissions or discharge or the age in years of a person over 89, telephone numbers, vehicle identifiers and serial numbers, including license plates, fax numbers, device identifiers and serial numbers, email addresses, web URLs, social security numbers, IP addresses, medical record numbers, biometric identifiers including finger and voice prints, health plan beneficiary numbers, full face photographs, account numbers, certificate/license numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISO 27001 and 27002

A

These relate to an org’s information security program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Olmstead v. US

A

Right to be left alone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is an investigative report under the FCRA?

A

under the FCRA, a consumer report becomes an investigative report when the process includes interviews with a person’s contacts to learn more about factors in the report such as “mode of living”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Can an ISP call an existing customer for telemarketing?

A

The Telemarketing sales rule does provide an existing business relationship exemption that would allow an ISP to call her even though she has added her phone to the DNC list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

FACTA

A

the Fair and Accurate Credit Transactions Act includes specialized guidance for organizations that use consumer reports. The basic requirement of the FACTA Disposal Rule is that covered organizations must take “reasonable measures to protect against unauthorized access or use of the information in connections with its disposal”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three main goals of a cybersecurity program?

A

confidentiality, integrity, and availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Industry best practice for frequency of privacy risk assessment

A

Annual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Articles 1, 2, 3

A

1 - Legislative, 2 - executive, 3 - judicial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Article IV

A

defines the relationship between the federal government and the governments of the states

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Article V

A

creates the process for amending the Constitution itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Article VI

A

contains the supremacy clause and the process to modify the Constitution through amendments (2/3 of each house of Congress and 38/50 states)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Article VII

A

process for the initial establishment of the federal government

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which states have privacy in their constitutions?

A

Alaska
Arizona
California
Florida
Hawaii
Illinois
Louisiana
Montana
New Hampshire
South Carolina
Washington.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Smyth v Pillsbury (Eastern District of Pennsylvania 1996)

A

Holding: employees generally do not have a right to privacy in their use of a company provided email account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Google v. CNIL (2019)

A

The right to be forgotten applies only within the EU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does FERPA not apply to?

A

employee professional education records maintained by hospitals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does HIPAA not apply to?

A

medical records maintained at student health centers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Does FERPA have a private right of action?

A

No but the DoE can bring a case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Does HIPAA have a private right of action?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Does GLBA have a private right of action?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Does the CCPA have a private right of action?

A

Yes if that breach involved certain unredacted and unencrypted personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the HIPAA civil penalties?

A

from $100 for a first time offense by an individual who did not know they were violating HIPAA to $50K if a violation was due to willful neglect and was not corrected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Does HIPAA have criminal penalties?

A

Yes.

$50K-$250K
1 - 10 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Negligence elements

A

Duty of care, breach of that duty, damages, causation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What key legislation grants the FTC authority over unfair and deceptive practices?

A

15 USC Section 45 (a)(1) aka UDAAP. This law is commonly cited as giving the FTC authority over privacy and cyber security related matters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which administrative body regulates websites targeted at children?

A

FTC through COPPA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the process for when the FTC has investigated a company and wants to bring a complaint?

A

The company can negotiate or contest the complaint in front of an ALJ. They can appeal to the five FTC commissioners after. Then, they can pursue an appeal in the federal courts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Sperry v. Hutchinson Trading Stamp co. (SCOTUS 1972)

A

Holding: Three factors for determining when a practices is unfair:
- if it injures consumers
- if it violates established public policy
- if it is unethical or unscrupulous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the test established by the FTC in its 1980 policy statement on unfairness to determine if a practice unfairly injures consumers?

A

Substantial
Outweighed
Not be reasonably avoidable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

FTC v. Wyndham Worldwide (Third Circuit)

A

Holding: A company does not act equitably when it publishes a privacy policy to attract customers who are concerned about data privacy, fails to make good on that promise by investing inadequate resources in cybersecurity, exposes its unsuspecting customers to substantial financial injury and retains the profits of their business

36
Q

LabMD - 2016

A

Example of unfair practice case brought by FTC in response to privacy issue

In 2016 the FTC issued a Final Order that LabMD suffered a data breach that impacted patient privacy as the direct result of insufficient cybersecurity practices. They were ordered to implement a cybersecurity program and subject themselves to periodic assessments.

37
Q

LifeLock - 2010

A

Example of unfair practice case brought by FTC in response to privacy issue

LifeLock ran an advertising campaign that it could prevent identity theft. They paid a $12M fine to the FTC and state governments. They also agreed to avoid deceptive advertising and implement strong security controls. In 2019 the company paid an additional $100M after they violated that court order.

38
Q

DesignerWare (2012)

A

Example of unfair practice case brought by FTC in response to privacy issue

A rent-to-own company was accused of placing spyware on the computers it rented that captured keystrokes and images of personal information. the FTC issued an order declaring this an unfair practice and prohibiting the company from engaging in similar practices in the future.

39
Q

What are the requirements for a practice to be deceptive? (1983 FTC Policy Statement)

A
  1. There must be a representation, omission or practice that is likely to mislead the consumer
  2. The practice must be examined from the perspective of a consumer acting reasonably in the circumstances
  3. The representation, omission or practice must be material
40
Q

GeoCities

A

This website hosting company collected personal information from customers, informing them that they would not resell this information. The FTC charged them with reselling information in violation of their privacy policy.

41
Q

Eli Lilly

A

This pharma company collected patient info on their website and then inadvertently sent an email to all site users disclosing their identities to one another

42
Q

Nomi

A

This tech company placed sensors in retail stores that collected info about consumers’ mobile devices without their knowledge or consent

43
Q

Snapchat

A

They informed consumers that messages and photos disappeared but they were aware of methods users engaged into preserve those messages

44
Q

TRUSTe

A

2014 deceptive practices - This privacy firm provides other companies with certifications of their privacy practices. The FTC charged them with failing to conduct annual recertifications of clients, as required. $200K fine.

45
Q

Zoom Consent Decree (2020)

A

Zoom had said their videos were end to end encrypted but they were point to point and were temporarily decrypted when on Zoom’s servers. The Decree made Zoom not say anything more about privacy and security, put in a comprehensive program and conduct annual independent audits for 20 years.

46
Q

What year was the Telecommunications Act?

A

1996

47
Q

What is CPNI and who regulates it?

A

Customer proprietary network information. The FCC regulates the way communications carriers may handle that information.

48
Q

How is broadband privacy handled by the FCC?

A

In Dec 2016 they passed a set of rules that would restrict ISPs from collecting and sharing info about customer comms, location data and browsing habits. In 2017 Trump repealed those privacy rules.

49
Q

Which US org operates the US portion of the Privacy Shield?

A

Department of commerce

50
Q

Which states have laws for UDAAP?

A

All

51
Q

What is PCI DSS?

A

Payment card Industry Data Security Standard (more about security than privacy but does include data retention reqs that protects consumers).

52
Q

What are the 12 high level requirements of PCI DSS?

A
  1. install and maintain a firewall config to protect cardholder data
  2. do not use vendor-supplied defaults for system passwords and other security parameters
  3. protect stored cardholder data
  4. encrypt transmission of cardholder data across open, public networks.
  5. use and regularly update antivirus software
  6. develop and maintain secure system and apps
  7. assign a unique ID to each person with computer access
  8. restrict physical access to cardholder data
  9. track and monitor all access to network resources
  10. restrict access to cardholder data by business need-to-know
  11. regularly test security systems
  12. maintain a policy that addresses information security for employees and contractors
53
Q

What is NAI?

A

Networking Advertising Initiative. They can investigate their members and sanction them. They can refer noncom[pliant companies to the FTC.

54
Q

What is the TRUSTe three phase process?

A
  1. Assessment
  2. Remediation and Certification
  3. Ongoing Monitoring and guidance
55
Q

What is the Schrems II ruling?

A

July 2020 - EU Court of Justice said that the Privacy Shield is illegal (the safe harbor program and agreement that allows orgs conducting data transfers between the EU and US to comply with GDPR only if the firm that have agreed to appropriate privacy standards).

56
Q

What is the largest fine the FTC has given?

A

Facebook - 2019. $5 billion based on deceptive claims about consumers’ ability to control the privacy of their personal data.

57
Q

When was PCI DSS created?

A

2004

58
Q

What are GPEN’s goals?

A
  1. Exchange information about privacy issues
  2. encourage sharing of enforcement expertise
  3. promote dialogue among enforcement groups
  4. facilitate intl cooperation
  5. support intl privacy practices
58
Q

What organization created the Global Privacy Enforcement Network?

A

OECD - Organization for Economic Cooperation and Development

59
Q

What kinds of information should an org consider when building a data inventory?

A

PII, PHI, financial information and government information

60
Q

What is the NIST?

A

National institute of Standards and Technology

61
Q

What is NIST 800-53?

A

NIST’s guidance that specifies different types of controls that should be used to protect information deemed low impact, moderate impact and high impact

62
Q

What is data minimization?

A

The company collects the smallest amount of info necessary to meet their business needs

63
Q

What is purpose limitation?

A

Businesses should use collected information only for the purpose for which it was originally collected

64
Q

How can electronic media be erased?

A

specialized sanitation software, degaussing using intense magnetic fields or physical destruction

65
Q

What is the FACTA disposal rule?

A

orgs must take “reasonable measures to protect against unauthorized access or use of the information in connection with its disposal”

66
Q

What are the FTC’s suggestions for reasonable measures to comply with FACTA’s disposal rule?

A
  1. policies and procedures that require burning, pulverizing, shredding paper that contain consumer information and monitoring compliance with that policy
  2. policies and procedures that require destruction or erasure of electronic media containing consumer information so it cant be read or reconstructed and monitoring compliance
  3. contracting with a record destruction business after doing due diligence on that business. customers may request certificates of destruction.
67
Q

What are the two reasons you should still be prepared for script kiddies?

A
  1. The tools are freely available on the internet so personal tech skills are no longer a barrier to hacks
  2. Script kiddies are plentiful and unfocused so they target many different orgs
68
Q

What ways did EUROPOL and IOCTA find that organized crime is active in cybercrime (2019)?

A

cyber dependent crime (ransomware, data compromise, website defacement, attacks against critical infrastructure), child sexual exploitation, payment fraud, dark web activity, terrorism, cross cutting crime factors like social engineering, money mules and abuse of crypto

69
Q

What company coined the term APT?

A

Mandiant - a security company

70
Q

What is a zero day attack?

A

attacks that exploit vulnerabilities that are researched by the hacker and are not known to other attackers or cybersecurity teams

71
Q

What is an event, an adverse event and a security incident?

A

Event - observable occurrence (examples - user accessing a file on a server, an administrator changing permissions, an attacker conducting a port scan)
Adverse event - event that has negative consequences (examples are malware infection, server crash, user accessing a file they are not authorized to view)
Security incident - violation or imminent threat of violation of security policies or practices (examples are accidental loss of sensitive info, intrusion by an attacker, use of keylogger on an exec’s system to steal passwords, and DoS attack)

72
Q

What is a CSIRT?

A

Computer security incident response team

73
Q

What are the steps of an incident response process?

A

Preparation, Detection & Analysis, Containment Eradication and Recovery, Post-Incident Activity

74
Q

What is NIST 800-61?

A

Four major categories of security event indicators:
Alerts, Logs, Publicly available information, People

75
Q

What is the process for the containment, eradication and recovery period in a security incident response?

A

Select a containment strategy, implement that strategy, gather additional evidence, identify the attackers, eradicate the effects

76
Q

What should NOT be included in a security incident policy?

A

specific technologies, response procedures, and evidence gathering techniques - those are for the procedures document

77
Q

What should be included in a security incident policy?

A

statement of management commitment
purpose and objectives
scope of the policy
definition of cybersecurity incidents
organizational structure and definition of roles
prioritization or severity rating scheme for incidents
performance measures for the CSIRT
reporting and contact forms

78
Q

What are places where PII may be incoming into an organization?

A

New employee onboarding
Benefits administration
Customer interactions
Independent contractor tax reporting

79
Q

What are the PII data inventory components?

A

Name of business process
Reason for using the PII
Legitimacy of use
Storage and transmission of PII
Access list
Third party involvement

80
Q

Virus v. worm malware

A

Virus - spreads from system to system through human interaction
Worm - spreads from system to system by itself

81
Q

How might adware be used?

A

changing the default search engine
displaying pop-up advertisements
replacing legitimate ads

81
Q

What is a good way to prevent Trojan Horses?

A

Application control on employee computers

82
Q

What are the three best ways to prevent malware?

A

Anti-malware software
Security patches
User education

83
Q

What are the components of a good incident response plan?

A
  1. policy and plan documentation
  2. procedures for incident handling
  3. guidelines for communicating externally
  4. structure and staffing model for the team
  5. description of relationship with other groups
84
Q

Incident Response Policy components

A
  1. foundational authority
  2. defines incidents
  3. incident prioritization scheme
85
Q

What are the four steps of an Information Management Program?

A

Discover
Build
Communicate
Evolve

CIPP (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions