301 terms
Cipm - Iapp
Strategic Management is the first high level necessary task to implement proactive privacy management through the following 3 subtasks:
(1) Define Privacy Vision and Privacy Mission Statement\n\n(2) Develop Privacy Strategy\n\n(3) Structure Privacy Team
Strategic management of privacy starts by creating or updating the organization vision and mission statement based on privacy best practices that should include:
(1) Develop vision and mission statement objectives\n\n(2) Define privacy program scope\n\n\n(3) Identify legal and regulatory compliance challenges\n\n\n(4) Identify organization personal information legal requirements
Define Privacy Program Scope
1) Identify & Understand Legal and Regulatory Compliance Challenges\nii) Identify the Data Impacted\n\nUnderstand Global Perspective\nCustomize Approach\nBe Aware of Laws, Regulations, Processes, Procedures\nMonitor Legal Compliance Factors
Types of Protection Models (4)
i) Sectoral (US)\nii) Comprehensize (EU, Canada, Russia)\niii) Co-Regulatory (Australia)\niv) Self Regulated (US, Japan, Singapore)
Questions to Ask When Determining Privacy Requirements (Legal)
- Who collects, uses, maintians Personal Information\n- What are the types of Personal Information\n- What are the legal requirements for the PI\n- Where is the PI stored\n- How is the PI collected\n- Why is the PI collected
Steps to Developing a Privacy Strategy (5)
i) ID Stakeholders and Internal Partnerships\nii) Leverage Key Functions\niii) Create a Process for Interfacing\niv) Develop a Data Governance Strategy\nv) *Conduct a Privacy Workshop
Data Governance Models (3)
i) Centralized\nii) Local/Decentralized\niii) Hybrid
What is a Privacy Program Framework?
Implementation roadmap that provides structure or checklists to guide privacy professionals through management and prompts for details to determine privacy relevant decisions.
Popular Frameworks (6)
APEC Privacy - regional data transfers\nPIPEDA (Canada) & AIPP (Australian)\nOCED\nPrivacy by Design\nUS Government
Steps to Develop Privacy Policies, Standards, Guidelines (4)
i) Assessment of Business Case \nii) Gap Analysis - \niii) Review & Monitor\niv) Communicate
Business Case
Defines individual program needs and way to meet specific goals.\n\n- Org Privacy Guidance\n- Define Privacy\n- Laws/Regs\n- Technical Controls\n- External Privacy Orgs\n- Frameworks\n- Privacy Enhancing Tech (PETs)\n- Education/Awareness\n- Program Assurance
What are the 4 Parts of the Privacy Operational Life Cycle
i) Assess\nii) Protect\niii) Sustain\niv) Respond
5 Maturity Levels of the AICPA/CICA Privacy Maturity Model?
i) Ad Hoc - Procedures informal, incomplete, inconsistently applied (not written)\nii) Repeatable - Procedures exist, partially documented, don't cover all areas\niii) Defined - All documented, implemented, cover all relevant aspects\niv) Managed - Reviews conducted assess effectiveness of controls\nv) Optimized - Regular reviews and feedback to ensure continuous improvements.
Privacy Assessment Approach (Key Areas)
i) Internal Audit & Risk Management\nii) Information Tech & IT Operations/Development\niii) Information Security\niv) HR/Ethics\nv) Legal/Contracts\nvi) Process/3rd Party Vendors\nvii) Marketing/Sales\nviii) Government Relations\nix) Accounting/Finance
11 Principles of the Data Life Cycle Management Model
i) Enterprise Objectives\nii) Minimalism\niii) Simplicity of Procedures & Training\niv) Adequacy of Infrastructure\nv) Information Security\nvi) Authenticity and Accuracy of Records\nvii) Retrievabiliyt\nviii) Distribution Controls\nix) Auditability\nx) Consistency of Policies\nxi) Enforcement
What is CIA & AA
Confidentiality\nIntegrity\nAvailability\n\nAccountability\nAssurance
What is the difference between positive & negative controls?
Positive - Enable privacy and business practices (win/win)\n\nNegative - Enable privacy but constrain business (win/lose)
What are the 3 high level security roles?
i) Executive\nii) Functional\niii) Corollary
What are the 7 foundation principles of Privacy by Design?
i) Proactive not Reactive; Preventative not Remedial\nii) Privacy as Default Setting\niii) Privacy Embedded into Design\niv) Full Funcationality\nv) End to End Security (Throughout Lifecyle)\nvi) Visibility and Transparency\nvii) Respect for User Privacy
3 keys to Sustainment?
i) Monitor\nii) Audit\niii) Communicate
4 keys to Response?
i) Information Requests\nii) Legal Compliance\niii) Incident Response Planning\niv) Incident Handling
Proactive privacy management is accomplished through three tasks
1) Define your organization's privacy vision and privacy mission statements 2) Develop privacy strategy 3) Structure your privacy team
This is needed to structure responsibilities with business goals
Strategic Management
Strategic Management model
Identifies alignment to organizational vision and defines the privacy leaders for an organization, along with the resources necessary to execute the vision.
Privacy professional
Member of the privacy team who may be responsible for privacy program framework development, management and reporting within an organization
Strategic management of privacy starts by
creating or updating the company's vision and mission statement based on privacy best practice
Privacy best practices
1) identify organization PI *legal requirements,2) Develop V&M statement objectives,3) identify legal & regulatory compliance challenges, &,4) define privacy program scope,
Vision or mission statement
This key factor that lays the groundwork for the rest of the privacy program elements and is typically comprised of a short sentence or two that describe the purpose and ideas in less than 30 seconds.
Strategic managment
Is the first high level task necessary to implement proactive privacy management.
Strategic management (3 subtasks)
(1) Define organization's (a) Privacy Vision and (b) Privacy Mission Statement\n\n\n(2) Develop Privacy Strategy\n\n\n(3) Structure Privacy Team
How do you create a company's: Privacy Vision?
(1) Acquire knowledge on privacy approaches\n\n\n(2) E valuate the intended objective\n\n\n(3) Gain executive sponsor approval for this Privacy Vision
How do you establish a Privacy Program?
(1) Define program scope and charter\n\n\n(2) Identify the sources, types, and uses of Personal Information (PI) within the org. and the applicable laws\n\n\n(3) Develop a Privacy Strategy
Elements of a Privacy Strategy?
(1) Business Alignment\n\n\n(2) Develop a data governance strategy for personal information (collection, authorized use, access, and destruction)\n\n\n(3) Plan inquiry/complaint handing procedures (customers, regulators, etc.)
Structuring the Privacy Team involves:
(1) Identifying and Establishing the appropriate Governance Model for your organization (usually based on size)\n\n\n(2) Responsibilities and reporting structure for Governance Model and Organization\n\n\n(3) Designate a point of contact for Privacy Issues\n\n\n(4) Establish/endorse the measurement of professional competency
Types of Governance Models?
(1) Centralized\n\n\n(2) Distributed\n\n\n(3) Hybrid
How do you develop the Privacy Program Framework?
(1) Develop organizational privacy policies, standards, and/or guidelines\n\n\n(2) Define Privacy Program activities
Privacy Program activities usually consist of:
(1) Education and awareness\n\n\n(2) Monitoring and responding to the regulatory environment\n\n\n(3) Internal policy compliance\n\n\n(4) Data inventories, data flows, and classification\n\n\n(5) Risk assessment (Privacy Impact Assessments, etc.)\n\n\n(6) Incident response and process, including jurisdictional regulations\n\n\n(7) Remediation\n\n\n(8) Program assurance, including audits
Implementing the Privacy Policy Framework consists of:
(1) Communicating the Framework to internal and external stakeholders\n\n\n(2) Ensuring continuous alignment to applicable laws and regulations to support the development of an organizational Privacy Program Framework
Ensuring continuous alignment to applicable laws and regulations to support the development of an organizational Privacy Program Framework consists of:
(1) Understanding applicable national laws and regulations\n\n\n(2) Understanding applicable local laws and regulations\n\n\n(3) Understanding the penalties for noncompliance \n\n\n(4) Understanding scope and authority of oversight agencies\n\n\n(5) Understand the privacy implications of doing business in or with countries with inadequate or without privacy laws\n\n\n(6) Maintain the ability to manage a global privacy function\n\n\n(7) Maintain the ability to track multiple jurisdictions for changes in privacy law\n\n\n(8) Understand international data sharing arrangements and agreements
Privacy Program Framework is:
An implementation road-map that provides the structure or checklists (document privacy procedures and processes) to guide the privacy professional through privacy management and prompts them for the details to determine all privacy-relevant decisions for the organization.
Privacy Framework benefits include:
Reduce risk; avoid incident of data loss; sustain organization market value and reputation and provide measurement in compliance to laws, regulations, and standards.
Developing organizational privacy policies, standards, and/or guidelines involves:
(1) Assessment of Business Case\n\n\n(2) Gap Analysis\n\n\n(3) Review and monitor privacy program\n\n\n(4) Communicate the framework
Ten foundational elements for privacy Business Case Development are:
(1) Organizational privacy office guidance\n\n\n(2) Define privacy\n\n\n(3) Laws and Regulations\n\n\n(4) Technical Controls\n\n\n(5) External Privacy Organizations\n\n\n(6) Industry Frameworks\n\n\n(7) Privacy Enhancing Technologies (PETs)\n\n\n(8) Information technology cutting-edge or innovation solutions\n\n\n(9) Education and Awareness\n\n\n(10) Program assurance or the governance structure
Organizational privacy office guidance:
If developed, offers the best staring point. This should be the first step, regardless of the program maturity.
Define Privacy:
As related to your program or organization. Use all available resources to determine the correct and appropriate definition of privacy for your org.
Laws and regulations
Provide the MANDATORY GOVERNMENT POLICY and guidance based on the organization's location and industry.
Technical Controls:
Provide the assurances necessary to achieve the goals of physical and data security.
External Privacy Organizations:
Serve as guardians or protectors against misuse, loss, or illegal practices.
Industry frameworks:
Provide taxonomies or privacy categorization guidelines that are not law or regulation based. (Eg. ISO, GAAP)
Privacy Enhancing Technologies:
Define privacy technology standards developed soley to be used for the transmission, storage and use of privacy data.
Information technology cutting-edge or innovation solutions:
Involve the use of newer or unregulated technology, such as social networking and the new Internet web cookie policy for eGov 2.0
Education and Awareness:
Provide methods to inform the employee of the important aspects of privacy and the basic protections a non-privacy professional should know.
Program assurance or the governance structure:
Mandate operational safeguards that include auditing.
Performing a gap analysis will...
determine the capability of current privacy management to support each of the business and technical requirements
Performance Measurement
The process of formulating or selecting metrics to evaluate implementation, efficiency or effectiveness; gathering data and producing quantifiable output that describes performance.
Metrics
Tools that facilitate decision making and accountability through collection, analysis, and reporting of data. They must be measurable, meaningful, clearly defined (with boundaries), indicate progress, and answer a specific question to be valuable and practical.
Five-Step Metric Life Cycle:
(1) Identify (metric audience)\n\n\n(2) Define (the metric owner)\n\n\n(3) Select (the specific privacy metric)\n\n\n(4) Collect (the data for the metric - Who, what, how, when, etc)\n\n\n(5) Analyze (statistical analysis, e.g., trend)
Metric - Identification
Identification of the intended audience: WHO will use the data?
Metric - Definition
Definition of data sources: WHO is the data owner and HOW is that data accessed?
Metric - Selection
Selection of privacy metrics: WHAT metrics to use based on the audience, reporting resources, and final selection of the best metric?
Metric - Collection
Collection and refinement of systems/application collection points: WHERE will the data come from to finalize the metric collection report? WHEN will the data be collected? WHY is tat data important?
Metric - Analyze
Analyze the data/metric to provide value to the organization and provide a feedback quality mechanism
Metric - Audience
Primary, secondary, and tertiary stakeholders who obtain value from a metric
Metric - Primary Audience
Includes: \n\n\nLegal and privacy officers\nSenior leadership; chief information officer\nChief security officer\nProgram managers\nInformation system owner\nInformation security officer
Metric - Secondary audience
Chief Financial officer\nTraining organizations\nHuman resources\nInspectors general\nHIPAA security officials
Metric - Tertiary audience
External watch dog groups\nSponsors\nStockholders
Metric - Owner
Process owner, champion, advocate and evangelist responsible for management of the metric throughout the metric life cycle
Metric - Sigma Six
Metric owner must:\n\n\n(1) Know what is critical about the metric. Why the output is important and understand how this metric fits into the business objectives.\n\n\n(2) Monitor process performance with the metric. Predictors of performance and monitoring data compiled by other metric owners, processes, or dependencies (operation, strategic, or tactical). \n\n\n(3) Make sure the process documentation is up to date.\n\n\n(4) Perform regular reviews. Determine if the metric is still required, capable to meet goals, and provides value to the organization.\n\n\n(5) Make sure that any improvements are incorporated and maintained in the process.\n\n\n(6) Advocate the metric to customers, partners, and others.\n\n\n(7) Maintain training, documentation, and materials.
Attributes of an effective Metric
Clear and concise metric that defines and measures progress toward a business objective or goal without overburdening the reader
Metric taxonomies; provide the following categories:
(1) Objective / Subjective\n\n\n(2) Quantitative / Qualitative\n\n\n(3) Information Technology Metrics / Quantitative Measurement\n\n\n(4) Static / Dynamic\n\n\n(5) Absolute / Relative\n\n\n(6) Direct / Indirect
Metrics - Improper
(1) Faulty Assumptions\n\n\n(2) Selective Use\n\n\n(3) The Well-chosen Average\n\n\n(4) Semi-attachment\n\n\n(5) Biased Sample\n\n\n(6) Intentional Deceit\n\n\n(7) Massaging the Numbers\n\n\n(8) Over-generalization
# of Metrics a Privacy Professional should select?
3 - 5
Examples of Compliance Metrics
(1) Collection (notice)\n(2) Responses to data subject inquiries\n(3) Use\n(4) Retention\n(5) Disclosure to third parties\n(6) Incidents (breaches, complaints, inquiries)\n(7) Employees trained\n(8) PIA metrics\n(9) Privacy risk indicators\n(10) % of company functions represented by governance mechanisms
Business Resiliency Metrics
ability to rapidly adapt and respond to business disruptions
Privacy Operational Life Cycle (POLC): Assess
(1) Document current baseline of your privacy\n(2) Processors and third party vendor assessment\n(3) Physical Assessments\n(4) Mergers, acquisitions, and divestitures\n(5) Conduct analysis and assessments, as needed or as appropriate
POLC Assess: 1. Document current baseline of your privacy
(a) Education and awareness\n(b) Monitoring and responding to regulatory environment\n(c) Internal policy compliance\n(d) Data, systems and process assessment\n(e) Risk assessment\n(f) Incident response\n(g) Remediation\n(h) Determine desired state and perform gap analysis against an accepted standard or law\n(i) Program assurance, including audits
POLC/Assess/1.d. Data, systems, and process assessment involves:
(1) Map data inventories, flows, and classification\n(2) Create "record of authority" of systems processing personal information within organization\n(3) Map and document data flow in systems and applications\n(4) Analyze and classify types and uses of data
POLC/Assess/Processors and 3rd party vendor assessment includes:
(1) Evaluate processors and third party vendors, in-sourcing and outsourcing privacy risks\n (a) Privacy and information security policies\n (b) Access controls\n (c) Where personal information is being held\n (e) Who has access to personal information\n\n\n(2) Understand and leverage the different types of relationships.\n (a) Internal audit\n (b) Information security\n (c) Physical security\n (d) Data protection authority\n\n\n(3) Risk Assessment\n\n\n(4) Contractual Requirements\n\n\n(5) Ongoing monitoring and auditing
POLC / Assess / Risk assessment:
(1) Type of data being outsourced\n(2) Location of data\n(3) Implication of cloud computing strategy\n(4) Legal compliance\n(5) Records retention\n(6) Contractual requirements (incident response, etc.)\n(7) Establish minimum standards for safeguarding information
POLC / Protect
(1) Data life cycle (creation to deletion)\n\n\n(2) Information Security Practices\n\n\n(3) Privacy by Design
POLC / Sustain
(1) Measure\n\n\n(2) Align\n\n\n(3) Audit\n\n\n(4) Communicate\n\n\n(5) Monitor
POLC / Sustain / Measure
(1) Quantify the costs of technical controls\n\n\n(2) Manage data retention with respect to the organization's policies \n\n\n(3) Define the methods for physical and electronic data destruction\n\n\n(4) Define the roles and responsibilities for managing the sharing and disclosure of data for internal and external use
POLC/ Sustain / Align
(1) Integrate privacy requirements and representations into functional areas across the organization
POLC / Sustain / Audit
(1) Align privacy operations to an internal and external compliance audit program\n\n\n(2) Audit compliance with privacy policies and standards\n\n\n(3) Audit data integrity and quality\n\n\n(4) Communicate audit findings with stakeholders
POLC / Sustain / Communicate
(1) Awareness\n\n\n(2) Targeted employee, management, and contractor training
POLC/ Sustain/ Communicate / Awareness
(1) Create awareness of the organization's privacy program\n\n\n(2) Ensure policy flexibility in order to incorporate legislative/regulatory/ market requirements\n\n\n(3) Develop internal and external communication plans to ingrain organizational accountability\n\n\n(4) Identify, catalog and maintain documents requiring updates as privacy requirements change
POLC / Sustain / Communicate / Targeted employee, managment, and contractor training...
(1) Privacy policies\n\n\n(2) Operational privacy practices (e.g., standard operating instructions), such as\n\n\n(a) Data creation/usage/retention/disposal\n(b) Access control\n(c) Reporting incidents\n(d) Key contacts
POLC / Sustain / Monitor
(1) Environment (e.g., systems, applications) monitoring\n\n\n(2) Monitor compliance with established privacy policies\n\n\n(3) Monitor regulatory and legislative changes\n\n\n(4) Compliance monitoring (e.g., collection, use, and retention) - can be done by : Internal Audits, Self-Regulation, Retention Strategy, or Exit Strategy
POLC / Respond
(1) Information Requests\n\n\n(2) Privacy Incidents
POLC / Respond / Information Requests
(1) Access\n\n\n(2) Redress\n\n\n(3) Correction \n\n\n(4) Managing data integrity
POLC / Respond / Privacy Incidents
(1) Legal Compliance\n\n\n(2) Incident Response Planning\n\n\n(3) Incident Detection\n\n\n(4) Incident Handling\n\n\n(5) Follow incident response process to ensure meeting jurisdictional, global and business requirements\n\n\n(6) Identify incident reduction techniques\n\n\n(7) Incident metrics - quantify the costs of a privacy incident
POLC / Respond / Privacy Incidents / Legal Compliance
(1) Preventing Harm\n\n\n(2) Collection Limitations\n\n\n(3) Accountability\n\n\n(4) Monitoring and enforcement
POLC / Respond / Privacy Incidents / Incident Response Planning
(1) Understand key roles and responsibilities (ID key business stakeholders and establish incident response teams).\n\n\n(2) Develop a privacy incident response plan\n\n\n(3) Identify elements of the privacy incident response plan\n\n\n(4) Integrate privacy incident response into business continuity planning
POLC / Respond / Privacy Incidents / Incident Detection
(1) Define what constitutes a privacy incident\n\n\n(2) Identify reporting process\n\n\n(3) Coordinate detection capabilities (w/ IT, Security, HR, Investigation team, Vendors)
POLC / Respond / Privacy Incidents / Incident Handling
(1) Understanding key roles and responsibilities\n\n\n(2) Develop a communications plan to notify executive management
POLC / Respond / Privacy Incidents/ Follow incident response process to ensure meeting jurisdictional, global, and business requirements by...
(1) Engage privacy team\n(2) Review the facts\n(3) Conduct analysis\n(4) Determine actions (contain, communicate, etc.)\n(5) Execute\n(6) Monitor
Need for Data Life Cycle Management (DLM)
DLM allows for identification and timely address of possible issues stemming from conflict of laws and differences in compliance with local legislation. Also, helps to decrease amount of info.
11 element DLM model
(1) Enterprise Objectives\n(2) Minimalism\n(3) Simplicity of Procedure and Effective Training\n(4) Adequacy of Infrastructure\n(5) Information Security\n(6) Authenticity and Accuracy of One's Own Records\n(7) Retreivability\n(8) Distribution Controls\n(9) Auditability \n(10) Consistency of Policies\n(11) Enforcement
CIA Triad
Confidentiality. Prevention of unauthorized disclosure of information.\n\n\nIntegrity. Ensures information is protected from unauthorized or unintentional alteration, modification or deletion.\n\n\nAvailability. Information is readily accessible to authorized users.\n\n\n+2 = Accountability, Assurance
There are only 2 forms of privacy control:
(1) Negative Controls - Enable privacy but constrain business (win/lose)\n\n\n(2) Positive Controls - Enable privacy and enable business objectives (win/win)
eof
eof
Proactive privacy management is accomplished through three tasks
1) Define your organization's privacy vision and privacy mission statements 2) Develop privacy strategy 3) Structure your privacy team
This is needed to structure responsibilities with business goals
Strategic Management
Identifies alignment to organizational vision and defines the privacy leaders for an organization, along with the resources necessary to execute the vision.
Strategic Management model
Member of the privacy team who may be responsible for privacy program framework development, management and reporting within an organization
Privacy professional
Strategic management of privacy starts by
creating or updating the company's vision and mission statement based on privacy best practice
Privacy best practices
1) identify organization PI legal requirements,\n\n 2) Develop V&M statement objectives, \n\n\n\n 3) identify legal & regulatory compliance challenges, &, \n\n \n4) define privacy program scope*,
This key factor that lays the groundwork for the rest of the privacy program elements and is typically comprised of a short sentence or two that describe the purpose and ideas in less than 30 seconds.
Vision or mission statement
This explains what you do as an organization, not who you are; what the organization stands for and why what you do an an organization to protect personal information is done
Mission Statement
What are the steps in the five step metric cycle
Identify, Define, Select, Collect, Analyze
The first step in the selecting the correct metrics starts by what?
Identifying the intended metric audience
The primary audience for metrics may include
Legal and privacy officers, senior leadership; CIO, CSO, PM, Information Systems Owner (ISO), Information Security Officer (ISO), Others considered users and managers
The secondary audience includes those who may not have privacy as a primary task include
CFO, Training organizations, HR, IG, HIPPA security officials
The tertiary audiences may be considered, based on the organization's specific or unique requirements such as who?
External watch dog groups, Sponsors, Stockholders
The difference between metrics audiences is based on what?
Level of interest, influence and responsibility to privacy within the business objectives, laws and regulations, or ownership
Specific to Healthcare metrics, audiences may include whom?
HIPPA privacy officers, medical interdisciplinary readiness teams (MIRTs), senior executive staff, covered entity workforce, self assessment tool and risk analysis/management
What is the second step in the metric life cycle?
Define Reporting Procedures
A metric owner must be able to do what?
Evangelize the purpose and intent of that metric to the organization
This person is the process owner, champion, advocate and evangelist responsible for management of the metric throughout the metric life cycle
Metric Owner
As Six Sigma teaches, an effective metric owner must do what?
1) Know what is critical about the metric, 2) Monitor process performance with the metric, \n\n 3) Make sure the process documentation is up to date,\n4) Perform regular reviews, \n5) Make sure that any improvements are incorporated and maintained in the process, \n6) Advocate the metric to customers, partners and others, and \n\n 7) Maintain training, documentation, and materials.
As a general practice, who should not perform the data collection tasks or perform the measurements of the metric?
Metric Owner
What is the third step in the metric life cycle
Select Privacy Metrics
Selecting the correct privacy metric requires what?
Full understanding of the business objectives and goals, along with a clear understanding of the primary business functions.
Prior to selecting metrics, the reader should first understand what?
Attributes of an effective metric with metric taxonomy and how to limit improper metrics.
An effective metric is a clear and concise metric that defines and measures what?
Progress toward a business objective or goal without overburdening the reader
Good metrics should not do what?
Overburden the reader
A metric should be clear in the meaning of what is being measured and what else?
1) Rigorously defined, 2) Credible and relevant, \n\n 3) Objective and quantifiable, and \n\n 4) Associated with the baseline measurement per the organization standard metric taxonomy.
If a standard metric taxonomy does not exist, privacy professionals can generate their own using the best practices from where?
NIST, NISTIR 7564, "Directions in Security Metrics Research"
A mission statement should include what five items?
Value the organization places on privacy, Desired organizational objectives, Strategies to drive the tactics used to achieve the intended outcomes, Clarification of roles and responsibilities
Strategic Management assigns roles, sets expectations grants powers and what?
Verifies performance
This model identifies alignment to organization vision and defines the privacy leaders for an organization, along with the resources (people, policy, processes, and procedures) necessary to execute vision
Strategic Management Model
This is a key factor that lays the groundwork for the rest of the privacy program elements and is comprised of a short sentence or two that describes purpose and ideas in less than 30 seconds
Mission Statement
What are the four steps in defining your organization's privacy vision and privacy mission statements
1. Develop Vision and Mission Statement Objectives 2. Define Privacy Program Scope 3.Identify Legal and Regulatory Compliance Challenges 4. Identify Organizational Personal Information Legal Requirements
What are the steps of Strategic Management?
Define Privacy and Mission, Develop Privacy Strategy, Structure Privacy Team
This is someone who understands the importance of privacy and will act as an advocate for you and for the program. Typically, they will have experience with the organization, the respect of their colleagues and access to or ownership of budget.
Program Sponsor
This is an executive who acts as an advocate and sponsor to further foster privacy as a core organization concept
Program Champion
Individual executives who lead and "own" the responsibility of the relevant activities are called what?
Stakeholders
As a rule, privacy policies and procedures are created and enforced at a what level?
Functional
Policies imposing general obligations on employees may reside with whom?
Ethics, legal and compliance
Policies and procedures that dictate certain privacy and security requirements on employees as they relate to the technical infrastructure typically sit with whom?
IT
Policies that govern requirements that need to be imposed on provider of third-party services that implicate personal data typically sit with whom?
Procurement
Policies that govern the use and disclosure of health information about employees of the organization typically reside with whom?
HR
This approach collects the various data-protection requirements and rationalizes them where possible
Pragmatic Approach
When defining your privacy program scope, you must first do what?
Understand and identify the legal and regulatory compliance challenges of the organization and identify the data impacted
If your organization plans to do business within a jurisdiction that has inadequate or no data protection regulations, you should do what?
Institute your organization's requirements, policies and procedures instead of reducing them to the level of the country
When developing your global privacy strategy, it must be relevant to what?
Markets, cultures, and geographical locations
According to Baker and McKenzie in their looking-ahead analysis of 2012, the goal of "achieving compliance" is steadily being replaced with what?
A corporate need to "achieve and maintain compliance"
What are examples of certain types of organizations and entities known as "covered entities"
Healthcare providers (hospitals, clinics, pharmacies) and health plans (medical plans, organization benefit plans) subject to HIPPA.
Merchants that handle cardholder information for debit, credit, prepaid, e-purse, ATM and POS cards must be in compliance with what?
Payment Card Industry Data Security Standard (PCI DSS), which is a global standard, not a law.
If you process personal information of any resident of a state that has adopted a breach notification law, understand that to the extent that non-encrypted data has been compromised, your compliance obligations may include notification to whom?
The residents of the states, as well as government bodies or state attorney general offices.
What is the first step when identifying Organizational Personal Information Legal Requirements
"roughing out" the scope of a privacy program by flagging areas in an organization where personal information is likely to be collected, access or used (HR, finance, marketing, customer relationship management systems, IT)
In the U.K., this regulation contains privacy rules for any form of electronic marketing, in addition to a vast array of statutes, regulations and voluntary codes of practice that govern direct marketing activity.
Privacy and Electronic Communications Regulations
Based on these three things, the privacy professional will need to determine the best methods, style and practices to working within the organization.
Individual culture, politics and protocols of the organization
This function is more closely aligned to the privacy group than any other function.
Information Security (IS)
This functional group adds processes and controls that support privacy principles. It creates processes to develop and test software and applications in a manner that does not require the use of production data decreases the chances that the data will be compromised and that individuals who have no business need will access the data
Information Technology (IT)
This functional group traditionally functions independently to assess whether controls are in place to protect personal information and whether people are abiding by these controls
Internal audit group
Many organizations create this, comprised of the same stakeholders that were identified at the start of the privacy program implementation process. Instrumental in making strategic decisions and driving such strategies and decisions through their own organizations.
Privacy committee or council
Organizations with a global footprint often create a governance structure that is comprised of whom?
Representatives from each geographic region and business function (ie., HR) in which the organization has a presence to ensure that proposed privacy policies, processes, and solutions align with local laws.
You first step when developing a Data-governance Strategy for Personal Information (Collection, Authorized Use, Access, Security, Destruction)
Take an inventory of relevant regulations that apply to your business. Once you determine which laws apply, you must design a manageable approach to handling and protecting personal information
This means implementing a solution that materially addresses the various requirements of the majority of laws or regulations with which you must comply.
Rationalization
Data-protection regulations typically include what items
• Notice • Choice \n\n • Consent \n\n • Purpose limitations \n\n • Limits on retaining data \n\n • Individual rights to access \n\n • Correction and deletion of data \n • Obligation to safeguard data
Privacy professionals should always involve whom to review, define or establish technical security controls, including common security controls such as firewalls, malware anti-virus, and complex password requirements
Security Engineer
This strategy seeks solutions that do not violate any data privacy laws, exceed budgetary restrictions or contradict organization goals and objectives
Strictest Standard
When positioning the privacy team, you should also consider the authority it will receive based on the what?
Governance model it follows
Executive leadership support for your governance model will have a direct impact on the level of success when implementing your privacy strategies. What are the important steps to integrate into any model?
o Involve senior leadership o Involve stakeholders \n\n o Develop internal partnerships \n\n o Provide flexibility \n\n o Leverage communications \n\n o Leverage collaboration
This type of governance fits well in organizations used to utilize single-channel functions (where direction flows from a single source) with planning and decision making completed by one group
Centralized Governance
This type of governance delegates decision-making authority down to the lower levels in an organization; relatively away from and lower than a central authority
Local or Decentralized
This is an implementation road map that provides the structure or checklists (document privacy procedures and processes) to guide the privacy professional through privacy management and prompts them for the details to determine all privacy-relevant decisions for the organization
Privacy Program Framework
Privacy governance framework provides the methods to what?
Access, protect, sustain and respond to the positive and negative effects of all influencing factors
This process provides the means to evaluate business rhythms, technical systems and associated costs to the strategic business objectives and performance of the organization.
Performance Measurement with Metrics Selection
This provides quantifiable output that is measurable, meaningful, answers specific questions and is clearly defined
Metrics performance
Major drivers impacting the increased need for privacy metrics include what?
Means of providing meaningful information on your privacy regime to key stakeholders, Generational change in the use of technology, Rapid advancements to technology, Catastrophes, such as data loss events, that drive tighter regulations, laws and standards, Current security and privacy solutions that are not designed to deal with the fast pace of emerging technologies or requirements, Privacy regulations becoming more stringent while privacy exceptions rise, Professionals embrace security and privacy as part of their job
Privacy Objectives are typically broad-based. What is an example of a privacy objective?
Privacy Notice
Privacy goals are specific and measurable. What is an example of a Privacy Goal?
Provide privacy notices to 100 percent of the customer base; number of privacy notices.
These provides common language between business, operational and technical managers to discuss the relevant information (e.g., good, bad, or indifferent) related to assessing progress.
Metrics
Generic privacy metrics should be developed to enable analyses of which processes?
o Collection (notice) o Responses to data subject inquiries \n\n o Use \n\n o Retention \n\n o Disclosure to third parties \n\n o Incidents (breaches, complaints, inquiries) \n\n o Employee training \n\n o Privacy Impact Assessment \n\n o Privacy risk indicators \n\n o Percent of organization functions represented by governance mechanisms
What are the steps of the Metric Life Cycle
o Identify the intended audience - Who will use the data o Define the data sources - Who is the data owner and how is that data accessed \n\n o Select privacy metrics - what metrics to use based on the audience, reporting resources and final selection of the best metric \n\n o Collect and refine systems/applications collection point - where will the data come from to finalize the metric collection report? When will the data be collected? Why is that data important? \n\n o Analyze the data/metrics to provide value to the organization and provide a feedback quality mechanism
This lists the metric characteristics that delineate boundaries between metric categories
Metric taxonomy
Metric taxonomies provide what categories?
Objective/Subjective, Quantitative/Qualitative, IT Metrics/Quantitative Measurement, Static/Dynamic, Absolute/Relative, Direct/Indirect
Objective metrics are more desirable than what type?
Subjective
These measurements typically map to best practices
Qualitative measurements
These type of measurements use data recorded within a numerical-mathematical fashion
Quantitative measurements
Per recent industry surveys, Chief Information Security Officers seem to prefer which type of measurements?
Qualitative measurements
This type of metric evolves with time
Dynamic measurements
The distinction between direct and indirect metrics is based on what?
The way a metric is measured
Size is an example of what type of metric
Direct
Quality or complexity can only be measured how?
Indirectly by extrapolation from other measured factors
The privacy professional must guard against improper conclusions such as these
Faulty Assumptions, Selective Use, Well-chosen Average, Semi-attachment, Biased Sample, Intentional Deceit, Massaging the Numbers, Overgeneralization
This conclusion is based on the occurrence of concurrent events without substantive evidence correlating the events
Faulty Assumptions
This is a specific subset of information is extrapolated from the larger data set, which leads to invalid/incorrect conclusions.
Selective Use
Many times the mean is used for a metric, but it is sometimes more appropriate to use the median or mode rather than the true mean/average
Well-chosen Average
When an individual is unable to provide their point, this may result with the exclusion of elements of a measurement when conveying results
Semi-attachment
This measurement completely excludes certain elements from the data population, thus providing on a partial set of data and leading to false assumptions
Biased Sample
An ethical issue, this occurs when data is knowingly and purposely omitted that may have a detrimental effect on the metric or metric owner
Intentional Deciet
This is slightly adjusting measurements to provide the appearance of success or other-than-actual results, leading the reviewer to believe the metric is more successful than it actually may be
Massaging the Numbers
This occurs when inferences are made concerning a general data population that leads to poor conclusions
Over-generalizations
As a basic business practice in the selection of metrics, the privacy professional should select how many key privacy metrics that focus on the key organizational objectives
Three to five
This is a data pattern that shows trends in an upwards or downward tendency i.e, privacy breaches over time
Time series
This is an indicator used to measure the financial gain/loss (or value) of a project in relation to its cost
Return on Investment (ROI)
Return on Investment (ROI) is measured how
(Benefits - Costs) / Costs
Privacy ROI defines metrics to measure the effectiveness of investments to protect investments in what?
Physical assets, Personnel assets, IT assets, Operational assets
This term relates to the protection of hardware, software, and data against physical threats, to reduce or prevent disruptions to operations and services and loss of assets
Physical assets
These are measures to reduce the likelihood and severity of accidental and intentional alteration, destruction, misappropriation, misuse, misconfiguration, unauthorized distribution and unavailability of an organization's logical and physical assets, as the result of action or inaction by insiders and known outsiders, like business partners
Personnel assets
Inherent technical features that collectively protect the organizational infrastructure, achieving and sustaining confidentiality, integrity, availability, and accountability.
IT assets
As it relates to ROI metrics, the first step is to identify and characterize the ROI metric to address what?
The specific risk that control or feature is supposed to mitigate
As it relates to ROI metrics, the second step is to define what
the value of the asset
This is the ability to rapidly adapt and respond to business disruptions and to maintain continuous business operations
Business Resiliency
The privacy professional or organization should include in the privacy budget the costs to generate what?
metrics
The most time consuming task of a privacy professional was of a strategic nature, which was what?
advising the organization on privacy issues
What are the phases of the privacy operational life cycle
o Assess (measure) o Protect (improve) \n\n o Sustain (evaluate) \n\n o Respond (support)
What are the PMM maturity levels?
Ad hoc, Repeatable, Defined, Managed, Optimized
This PMM maturity level indicates procedures or processes are generally informal, incomplete, and inconsistently applied
Ad hoc
This PMM maturity level indicates procedures or processes exist; however, they are not fully documented and do not cover all relevant aspects
Repeatable
This PMM maturity level indicates procedures or processes are fully documented and implemented and cover all relevant aspects
Defined
This PMM maturity level indicates that reviews are conducted to assess the effectiveness of the controls in place
Managed
This PMM maturity level indicates that regular review and feedback is used to ensure continuous improvement towards optimization of the given process
Optimized
What are the seven foundational principles of PbD?
Proactive not Reactive-Preventative not Remedial; Privacy as the Default Setting; Privacy Embedded into Design; Full Functionality-Positive Sum not Zero-sum; End-to-End Security-Full Life Cycle Protection; Visibility and Transparency; Respect for User Privacy
This ensures that privacy and security controls and aligned with an organization's tolerance for risk and its compliance with regulations and commitment to building a sustainable privacy-minded culture
PbD paradigm
One tool used to determine whether a PIA should be conducted is called what?
Privacy Threshold Analysis (PTA)
These type of assessments further assist the privacy professional in the Protect phase
PIA, risk assessments, security assessments
This is a policy-based approach to manage the flow of information through a life cycle from creation to final disposition
DLM/ILM
Main drivers of DLM/ILM
1. Enterprise data growth 2. Growth in unstructured data \n\n 3. Limitations in relational database management system performance \n\n 4. Information access and security concerns\n5. Lack of effective methods for classifying data \n6. Difficulty in assessing productivity of systems, applications and databases
Main benefits of DLM and ILM are what?
Increased control over data, regulatory compliance (thereby minimizing business risk) and reduced costs (by eliminating redundancies in data storage
In the EU, who retains legal liability for any harm associated with the collected data?
Data Controller
OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, what are five factors that should be considered in a data breach?
Nature of the data elements breach, number of individuals affected, likelihood that the information is accessible and usable, likelihood the breach may lead to harm, the organization's ability to mitigate the risk of harm
What does the Federal government guidance state when a breach poses little or no risk of harm?
Notification could create unnecessary concern and confusion
To establish tort liability, a third-party plaintiff must show what?
That the organization owed to him or her duty of care
A breach will typically involve
Third party hacker who intentionally exploits vulnerabilities of the customer system, Customer failure to properly operate, use or secure its systems, Lost or stolen computer equipment, Misconduct of customer employees
As part of the incident-response planning process, this group will provide guidance regarding the detection, isolation, removal, and preservation of affected systems.
Information Systems (IS)
One of this group's primary role after a breach is to advise corporate privacy and executive teams on response notification requirements, in particular, who should be notified, how and when
Legal
In the aftermath of a data breach, this group may serve as the organization's informational conduit, working closely with PR or corporate communications to inform and update employees about the incident
HR
This group's role during a data breach can be to work with management and PR teams to establish and maintain a positive, consistent message, during both the crisis and the post-breach notifications
Marketing
Because of their unique association with customers and the bond of trust built carefully over time, this group is often asked to notify key accounts when their data has been breached
BD
When a data breach occurs, these stakeholders quickly assume their position on the front lines, preparing for the response to potential media inquiries and coordinating internal and external status updates
Communications and PR
After a breach occurs, the primary role for this stakeholder is to provide members with timely updates and instructions.
Union Leadership
One of the first and arguably most critical steps taken by the top executive is to what?
Promptly allocate funds and manpower needed to resolve the breach.
This plan is typically drafted and maintained by key stakeholders, spelling out departmental responsibilities and actions teams must take before, during, and after a data breach
Business Continuity Plan (BCP)
In a 2011 survey of 400 IT executives, one-fifth indicated these events had made business continuity planning a much higher priority in recent years?
Natural disasters, security and terrorist threats
This is a structured readiness testing activity that simulates an emergency situation in an informal, stress-free setting
Table top exercise
Generally speaking, this may be described as any potential or actual compromise of personal information in a form that facilitates intentional or unintentional access by unauthorized third parties
Privacy incident
A 2012 study revealed what groups were most often the cause for privacy incidents?
Insiders and third parties
This is the internal process of employees alerting supervisors about a security-related incident, who in turn report the details to a predefined list of experts
Escalation
This is the process of informing affected individuals that their personal data has been breached
Notification
Assuming privacy incident notification is required, organizations generally have how long to notify the affected individuals
60 days
This is one method enforcing security and accountability in how personal data is handled by third parties
Binding contractual obligations and reporting requirements
This activity triggers the pre-notification process
Once breach investigators conclude that an actual compromise of sensitive information has occurred
Generally, most well-conceived incident response plans account for and/or include which elements?
Key stakeholders, Execution timeline, Progress reporting and Response evaluation and modifications
Common reporting intervals in incident response plans include what?
Hourly, daily, weekly, monthly
Reporting resources can be found with the technical and business characteristics of an organization that include
People, Processes, Technology
These are two complimentary processes that prepare an organization for crises and managing the business afterwards, thereby reducing risk.
Business Continuity and Disaster Recovery Planning (BCDR)
Privacy is concerned with an individual's ability to control the use of personal information while information security focuses on what?
Mechanisms for protection of information and information systems
CIA triad in additional to further advanced information security concepts are what?
Confidentiality, Integrity, Availability, Accountability, Assurance
Separation of legal, compliance, internal audit and security functions: collaboration is more challenging, but what?
functional independence is assured
Combining of legal, compliance, internal audit and security functions: collaboration is assured, but what?
functional independence is more challenging
What are the steps of the Audit Life Cycle?
Planning, Preparation, Audit, Report, Follow-up
What are the three types of audit categories?
First party/internal audit, Second-party audits, Third-party/external audits
These audits are a form of "self-evaluation"
First-party/internal audits
These types of audits are typically Supplier Audits because they are used where an organization has to assure itself of the ability of a potential or existing supplier or subcontractor to meet the requirements.
Second-party audits
This is a form of internal audit that does not exempt an organization from fulfilling obligations under applicable laws or regulations
Self-Certification
A well known self certification framework is what?
US-EU Safe Harbor
The Sustain phase of the privacy operational life cycle provides privacy management through what?
Monitoring, auditing, and comunication
The Respond phase of the privacy operational life cycle includes which principles?
Information requests, legal compliance, incident response planning and incident handling
The form of Redress that is offered to the complainant should be clearly defined in what?
Your complaint response process and documented for resolution
Data integrity issues are often the results of what?
Human failure or systemic error.
The fundamental principle that should govern a privacy incident is to what?
Allow an affected person the opportunity to protect themselves from identify theft or other harm
The primary focus when managing any privacy incident is always what?
Harm prevention and/or minimization
It is best practice to have the notice of a breach issued to the affected individuals by whom?
The organization that these individuals are likely to recognize from a prior or current relationship
The privacy statement should indicate:
(1) The value the organization places on privacy\n\n\n(2) Desired organizational objectives\n\n\n(3) Strategies to drive the tactics used to achieve the intended outcomes\n\n\n(4) Clarification of roles and responsibilities
Privacy Worshop
Conduct a privacy workshop for your stakeholders to level the privacy playing field by defining privacy for the organization, explaining the market expectations, answering questions, and reducing confusion.
What enables you to create a data-governance strategy for your organization?
Taking an inventory of relevant regulations that apply to your business.
Rationalizing requirements (as part of creating a data governance strategy) means...
Taking a more pragmatic approach and collect the various data protection requirements and "rationalize" them where you can. Rationalizing means implementing a solution that materially addresses the various requirements of the majority of laws and regulations which you must comply. * must address high risk exceptions as part of this process too!
Strictest Standard (another data governance strategy for personal information)
Look to the strictest standard when seeking a solution; provided it does not violate any (1) data privacy laws (2) exceed budgetary restrictions (3) contradict organization goals and objectives.
First step of developing a Privacy Policy Framework?
Assessment of the Business Case for the current (or forthcoming) privacy program or privacy requirements for privacy policies, standards, and/or guidelines.
Second step of developing a Privacy Policy Framework?
A gap analysis of the information collected for the Business Case, ensuring there are no gaps or holes in the current or developing privacy program.
Third and final step of developing a Privacy Policy Framework?
Review and Monitor the program and Communicate the Privacy Policy Framework.
No matter the size of an organization, if the core business of the organization revolves around the processing of personal data...
...having in place as thorough a Privacy Policy Framework as possible becomes all the more important and should be prioritized within the organization.
Business Case (as a step in developing the Privacy Policy Framework)
Allows for the understanding of the role of privacy in the context of business requirements and identification of business benefits and risks.
Privacy Domain (third step in developing the Privacy Policy Framework)
Privacy Domain - determines the privacy elements, such as industry, privacy organizations and other data, that will provide the necessary laws, standards, guidelines and other factors that should be evaluated.
One method that can be used as a baseline for assessing your privacy program...
Consider how valuable, sensitive, or confidential the personal information is and what damage or distress could be caused to individuals if there was a security breach.
Establishing the CURRENT BASELINE of your privacy program (PP) is the process of collecting "as-is" data privacy requirements in order to document the current environment and any protections or policies in place...usually includes collecting info on:
(1) Collection Limitation\n(2) Data Quality\n(3) Purpose Specification\n(4) Use Limitation\n(5) Security Safeguards\n(6) Openness\n(7) Individual Participation\n(8) Accountability
Est. Current Baseline of PP, Collection Limitation:
There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.
Est. Current Baseline of PP, Data Quality:
Personal data should be relevant to the purpose for which they are to be used, and, to the extent necessary for those purposes should be accurate, complete, and kept up-to-date.
Est. Current Baseline of PP, Purpose Specification:
The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.
Est. Current Baseline of PP, Use Limitation:
Personal data should not be disclosed, made available or otherwise used for purposes other than those specified, except with the consent of the data subject or by the authority of law.
Est. Current Baseline of PP, Security Safguards:
Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data.
Est. Current Baseline of PP, Openness:
There should be a general policy of openness about developments, practices, and policies with respect to personal data. Means should be readily available to establish the existence and nature of personal data, and the main purpose of their use, as well as the identify and usual residence of the data controller.
Est. Current Baseline of PP, Individual Participation:
An individual should have the right: (a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; (b) to have communicated to him, data relating to him within a reasonable time; at a charge, if any, that is not excessive; in a reasonable manner; and in a form that is readily intelligible to him; (c) to be given reasons if a request made under sub-paragraphs (a) and (b) is denied, and to be able to challenge such denial; and (d) challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed, or amended.
Est. Current Baseline of PP, Accountability:
A data controller should be accountable for complying with measures which give effect to the principles stated above (Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, and Individual Participation).
Key aspects of Internal Policy include:
(1) a formal written policy and\n(2) designated points of contact
Internal Policy, Written Policy:
Should document the principles, policies, and practices that influence privacy for the organization. Provide direction on org. privacy practices, privacy roles and responsibilities, breach or incident documents, privacy ownership, assign stakeholders. They should also provide formal procedures for receiving and resolving privacy-related inquiries and complaints from both internal and external sources.
Internal Policy, Designated Point of Contact:
E.g., Privacy Office or Privacy Officer. This contact can also serve as the liaison to information security, legal and human resources.
Privacy Function:
Is not a standalone function. It is imperative that the privacy professional work closely with the IT, security, HR and legal functions in order to take a coordinated approach to solutions.
ISOs ( Information Security Owner or Information Security Officer)
While, stakeholders at all levels should be involved in the selection and management of any metric to ensure buy-in and a sense of ownership, ISOs are seen as a primary audience for metrics data because they have a higher level of interest, influence, and responsibility to privacy with the business objectives, laws and regulations, or ownership.
Performance Measurement
The process of formulating or selecting metrics to evaluate implementation, efficiency or effectiveness.
Tracking and bench-marking data protection indicators through Performance Measurement is important because...
it ensures proper data protections are in place within businesses and between employees, consumers, and customers.
Effective Metrics:
(1) define and measure progress toward business goals and objectives\n\n\n(2) Should be concise - large amounts of useless info is counterproductive\n\n\n(3) Should be clear in the meaning of what is being measured\n\n\n(4) rigorously defined\n\n\n(5) credible and relevant\n\n\n(6) objective and quantifiable \n\n\n(7) associated with the baseline measurement per the organization standard metric taxonomy
Data Inventory
Conducting a data inventory reveals where personal data resides, which will identify the data as it moves across various systems and thus how data is shared and organized and its locations. That data is then categorized by subject area, which identifies inconsistent data versions, enabling identification and mitigation of data disparities. The data inventory offers a good starting point for the privacy team to prioritize resources, efforts, risk assessments and current policy in response to incidents.
Privacy Governance Framework
Provides the methods to access, protect, sustain, and respond to the positive and negative effects of all influencing factors. This master plan, or framework, thereby provides reusable procedures and checklists that outline the operational life cycle courses of action, research, and subject matter expertise, constituting a "best practice" approach to an idea, thought or subject. Like maps, frameworks provide inquiry topics and direction (e.g., problem definition, purpose, literature review, methodology, data collection and analysis) to ensure quality through repeatable steps throughout program management, thereby reducing errors or gaps in knowledge or experience.
Training Programs
Dealing with privacy policies should be based on clear polices and standards and have ongoing mechanisms and processes to educate and guide employees in implementation. Everyone who handles personal information needs to be trained in privacy policies and how to deploy them within their area to ensure compliance with all policy requirements. This applies to employees, management, contractors and other entities with which your organization might share personal information.
Technical Controls
such as implementing systems that support role-based access, also support the larger purposes of the privacy program by specifically identifying and limiting who can access the personal information in a particular database.
Breaches
Not all breaches require notification. There are various types of notification requirements to regulators and affected individuals. Once it is concluded that an actual compromise of sensitive information has occurred, the pre-notification process is triggered. Steps taken may vary depending on several factors, but the purpose is to confirm that the event does indeed constitute a "reportable" breach.