CGRC CGRC Privacy and Data Protection

Question 1

Which U.S. federal law establishes privacy and security requirements for federal agencies' handling of personally identifiable information (PII)?

Accepted Answer

The Privacy Act of 1974

Answer

The Privacy Act of 1974 governs how federal agencies collect, maintain, use, and disclose PII about individuals, granting citizens rights over their records.

Question 2

What is Personally Identifiable Information (PII) as defined by NIST?

Accepted Answer

Information that can be used to distinguish or trace an individual's identity

Answer

NIST defines PII as any information that can be used alone or in combination with other information to identify, contact, or locate a specific individual.

Question 3

What document must federal agencies publish to notify the public about a system that collects and maintains PII?

Accepted Answer

System of Records Notice (SORN)

Answer

A System of Records Notice (SORN) is published in the Federal Register to inform the public about a system that retrieves records by personal identifiers.

Question 4

Under the CGRC framework, which assessment evaluates privacy risks associated with collecting, storing, and using PII in a federal system?

Accepted Answer

Privacy Impact Assessment (PIA)

Answer

A Privacy Impact Assessment (PIA) analyzes how PII is collected, used, shared, and protected, identifying and mitigating privacy risks.

Question 5

Which NIST SP 800-53 control family specifically addresses privacy requirements integrated into the security control framework?

Accepted Answer

PT – PII Processing and Transparency

Answer

NIST SP 800-53 Rev. 5 introduced the PT (PII Processing and Transparency) family, which includes controls for consent, purpose specification, and data minimization.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC CGRC Privacy and Data Protection