CGRC CGRC Privacy and Data Protection

Question 1

Which U.S. federal law establishes privacy and security requirements for federal agencies' handling of personally identifiable information (PII)?

Accepted Answer

The Privacy Act of 1974

Answer

HIPAA

Answer

GLBA

Answer

COPPA

Question 2

What is Personally Identifiable Information (PII) as defined by NIST?

Accepted Answer

Information that can be used to distinguish or trace an individual's identity

Answer

Any data stored on a federal system regardless of sensitivity

Answer

Encrypted data that has been anonymized

Answer

Technical system configuration data

Question 3

What document must federal agencies publish to notify the public about a system that collects and maintains PII?

Accepted Answer

System of Records Notice (SORN)

Answer

System Security Plan (SSP)

Answer

Privacy Impact Assessment (PIA)

Answer

Data Flow Diagram (DFD)

Question 4

Under the CGRC framework, which assessment evaluates privacy risks associated with collecting, storing, and using PII in a federal system?

Accepted Answer

Privacy Impact Assessment (PIA)

Answer

Business Impact Analysis (BIA)

Answer

Security Assessment Report (SAR)

Answer

Risk Assessment Report (RAR)

Question 5

Which NIST SP 800-53 control family specifically addresses privacy requirements integrated into the security control framework?

Accepted Answer

PT – PII Processing and Transparency

Answer

AC – Access Control

Answer

AT – Awareness and Training

Answer

MP – Media Protection

Question 6

What is the principle of data minimization in the context of privacy protection?

Accepted Answer

Collecting and retaining only the minimum amount of PII necessary for the stated purpose

Answer

Encrypting all PII using the strongest available algorithm

Answer

Storing PII in the fewest number of databases possible

Answer

Limiting access to PII to only one authorized user