CGRC Privacy and Data Protection Flashcards

A U.S. federal agency's system processes records subject to the Privacy Act of 1974. During the CGRC Select step, the Authorizing Official asks which NIST SP 800-53 Rev. 5 control family and associated process specifically address the requirement that the agency determine whether a Privacy Impact Assessment is needed and designate who is accountable for the privacy risk of the system. Which is the BEST answer?

Answer: The PM (Program Management) family, with the Senior Agency Official for Privacy (SAOP) assigned responsibility and privacy controls selected through the RMF alongside security controls

In Rev. 5 privacy controls are integrated with security controls. The PM family (for example PM-18 privacy program plan, PM-19 privacy program leadership role) establishes the privacy program and the SAOP's role. System-level privacy risk is managed through the RMF, with privacy controls selected and assessed alongside security controls, and the PIA is supported by RA-8. PT alone does not cover program accountability, SC is unrelated to privacy governance, and RA-only ignores the required role of the privacy official.

During continuous monitoring, an organization discovers that a system component began collecting additional PII elements (precise geolocation) under a feature update that did not change the system's authorization boundary or security categorization. Which action is MOST appropriate under RMF and the Privacy Act/OMB guidance?

Answer: Treat it as a significant change to the privacy risk posture: reassess privacy risk, update the PIA and applicable SORN if the records or purposes change, and revise the control selection and the SSP/privacy plan accordingly

Privacy risk is distinct from security categorization. New PII collection can alter the privacy risk assessment, require a PIA update, and potentially require a new or modified SORN under the Privacy Act. These changes should flow through the change management and continuous monitoring process, including updates to control selection and authorization documents. An unchanged FIPS 199 category does not exempt the change, and automatic ATO revocation is not required.

A system processes personal data of EU residents and the organization relies on contractual commitments with a U.S. cloud service provider. The CGRC practitioner is evaluating the security assessment of inherited controls. Which statement about the roles and the evidence needed is MOST accurate?

Answer: The organization remains accountable for the processing and must obtain evidence (such as an authorization package, audit report, or data processing agreement terms) that inherited and shared controls meet its privacy and security requirements, and document the responsibility split in the SSP

Contracts can allocate operational responsibilities but do not remove the controller or system owner's accountability. The RMF requires that inherited and shared controls be identified, with supporting evidence such as an authorization package or independent assessment, and documented in the SSP so the authorizing official can make a risk-based decision.

An agency's system of records is used for a new purpose that is NOT compatible with the purpose stated in the existing SORN, and the agency wishes to share the records with another federal agency. Under the Privacy Act framework, which approach is MOST defensible?

Answer: Publish a new or modified routine use through a SORN revision (including required notice and comment period and any required reports to OMB and Congress) before the disclosure, unless another Privacy Act exception applies

The Privacy Act prohibits disclosure of records without the individual's written consent unless an exception applies, such as a published routine use compatible with the collection purpose. A new routine use requires a SORN modification with a 30-day public comment period and advance notice to OMB and Congress. Sharing between agencies is not automatically exempt, and removing names alone does not guarantee de-identification.

While assessing a system, the assessor finds that logs retain full unmasked PII (SSNs) in an application debug log that is accessible to the operations team. The system's documented purpose does not require SSN retention in logs. Which finding and remediation BEST reflects privacy principles of data minimization and the assessor's role?

Answer: Record a finding against the minimization and PII handling controls (for example, the PT and SI families and AU-3 content restrictions), recommend removing or masking SSNs in logs and purging existing entries, and track remediation in the POA&M, while the assessor does not fix the issue directly

Assessors independently evaluate and report. The excessive PII in logs conflicts with data minimization (SI-12 and the PT controls) and the need to limit audit record content. The assessor reports the weakness in the SAR, and the system owner remediates and tracks it in the POA&M. Assessors do not modify production data or accept risk, as only the AO can accept risk.

A privacy officer is deciding how to treat a dataset in which direct identifiers were replaced by a keyed token, and the key is retained by the same organization in a separate secured system. How should the dataset be characterized for privacy risk purposes?

Answer: Pseudonymized data that remains PII because re-identification is possible with the retained key, so privacy controls still apply, though the separation of the key reduces risk

If the organization (or someone with access) can reverse the tokenization using the retained key, the data is still linkable to individuals and remains PII or personal data. Pseudonymization is a risk-reduction safeguard, not anonymization. Protecting the key separately lowers risk but does not remove the data from privacy obligations.