Iapp - Cipm

Front 1

3 Subtask of Strategic Management

Back 1

i) Define Privacy Vision and Privacy Mission Statement
ii) Develop Privacy Strategy
iii) Structure Privacy Team

Front 2

What should a privacy vision/mission statement include? (4)

Back 2

i) Develop Privacy Objectives
ii) Define Scope
iii) Identify Legal & Regulatory Compliance Challenges
iv) Identify Personal Information Legal Requirements

*Be less than 30 seconds

Front 3

What is the difference between a vision statement & mission statement?

Back 3

Vision - Describes purpose and ideas

Mission - What you do, What you stand for, Why

Front 4

Key Steps to Define Scope (2)

Back 4

i) Identify & Understand Legal and Regulatory Compliance Challenges
ii) Identify the Data Impacted

*Understand Global Perspective
*Customize Approach
*Be Aware of Laws, Regulations, Processes, Procedures
*Monitor Legal Compliance Factors

Front 5

Types of Protection Models (4)

Back 5

i) Sectoral (US)
ii) Comprehensize (EU, Canada, Russia)
iii) Co-Regulatory (Australia)
iv) Self Regulated (US, Japan, Singapore)

Front 6

Questions to Ask When Determining Privacy Requirements (Legal)

Back 6

- Who collects, uses, maintians Personal Information
- What are the types of Personal Information
- What are the legal requirements for the PI
- Where is the PI stored
- How is the PI collected
- Why is the PI collected

Front 7

Steps to Developing a Privacy Strategy (5)

Back 7

i) ID Stakeholders and Internal Partnerships
ii) Leverage Key Functions
iii) Create a Process for Interfacing
iv) Develop a Data Governance Strategy
v) *Conduct a Privacy Workshop

Front 8

Data Governance Models (3)

Back 8

i) Centralized
ii) Local/Decentralized
iii) Hybrid

Front 9

What is a Privacy Program Framework?

Back 9

Implementation roadmap that provides structure or checklists to guide privacy professionals through management and prompts for details to determine privacy relevant decisions.

Front 10

Popular Frameworks (6)

Back 10

APEC Privacy - regional data transfers
PIPEDA (Canada) & AIPP (Australian)
OCED
Privacy by Design
US Government

Front 11

Steps to Develop Privacy Policies, Standards, Guidelines (4)

Back 11

i) Assessment of Business Case
ii) Gap Analysis -
iii) Review & Monitor
iv) Communicate

Front 12

Business Case

Back 12

Defines individual program needs and way to meet specific goals.

- Org Privacy Guidance
- Define Privacy
- Laws/Regs
- Technical Controls
- External Privacy Orgs
- Frameworks
- Privacy Enhancing Tech (PETs)
- Education/Awareness
- Program Assurance

Front 13

What are the 4 Parts of the Privacy Operational Life Cycle

Back 13

i) Assess
ii) Protect
iii) Sustain
iv) Respond

Front 14

5 Maturity Levels of the AICPA/CICA Privacy Maturity Model?

Back 14

i) Ad Hoc - Procedures informal, incomplete, inconsistently applied (not written)
ii) Repeatable - Procedures exist, partially documented, don't cover all areas
iii) Defined - All documented, implemented, cover all relevant aspects
iv) Managed - Reviews conducted assess effectiveness of controls
v) Optimized - Regular reviews and feedback to ensure continuous improvements.

Front 15

Privacy Assessment Approach (Key Areas)

Back 15

i) Internal Audit & Risk Management
ii) Information Tech & IT Operations/Development
iii) Information Security
iv) HR/Ethics
v) Legal/Contracts
vi) Process/3rd Party Vendors
vii) Marketing/Sales
viii) Government Relations
ix) Accounting/Finance

Front 16

11 Principles of the Data Life Cycle Management Model

Back 16

i) Enterprise Objectives
ii) Minimalism
iii) Simplicity of Procedures & Training
iv) Adequacy of Infrastructure
v) Information Security
vi) Authenticity and Accuracy of Records
vii) Retrievabiliyt
viii) Distribution Controls
ix) Auditability
x) Consistency of Policies
xi) Enforcement

Front 17

What is CIA & AA

Back 17

Confidentiality
Integrity
Availability

Accountability
Assurance

Front 18

What is the difference between positive & negative controls?

Back 18

Positive - Enable privacy and business practices (win/win)

Negative - Enable privacy but constrain business (win/lose)

Front 19

What are the 3 high level security roles?

Back 19

i) Executive
ii) Functional
iii) Corollary

Front 20

What are the 7 foundation principles of Privacy by Design?

Back 20

i) Proactive not Reactive; Preventative not Remedial
ii) Privacy as Default Setting
iii) Privacy Embedded into Design
iv) Full Funcationality
v) End to End Security (Throughout Lifecyle)
vi) Visibility and Transparency
vii) Respect for User Privacy

Front 21

3 keys to Sustainment?

Back 21

i) Monitor
ii) Audit
iii) Communicate

Front 22

4 keys to Response?

Back 22

i) Information Requests
ii) Legal Compliance
iii) Incident Response Planning
iv) Incident Handling