CIPM Privacy Risk Management Flashcards

Which four options are commonly used to treat privacy risks identified during a risk assessment?

Answer: Avoid, mitigate, transfer, and accept

The four standard risk treatment options are: avoid (stop the risky activity), mitigate (reduce the risk), transfer (share risk via insurance or contracts), and accept (acknowledge and proceed with residual risk).

What is the primary goal of threat modeling in a privacy risk management context?

Answer: To identify potential threats to personal data and design controls before they are exploited

Threat modeling proactively identifies potential adversaries, attack vectors, and vulnerabilities that could compromise personal data, enabling the design of appropriate preventive controls.

Which NIST Special Publication provides a catalog of security and privacy controls for federal information systems?

Answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls that federal agencies and contractors can use to protect information systems and personal data.

What is the purpose of a privacy threshold assessment (PTA)?

Answer: To determine whether a full PIA or DPIA is required for a given project

A privacy threshold assessment is a preliminary screening tool that evaluates whether a proposed project or system involves sufficient privacy risk to warrant a full PIA or DPIA.

How does an organization's 'risk appetite' influence its privacy program decisions?

Answer: It defines the level of risk the organization is willing to accept before taking additional action

Risk appetite establishes the threshold of acceptable risk, guiding decisions on which privacy risks require treatment and which residual risks can be tolerated without further controls.

What is the primary role of a Data Protection Officer (DPO) in an organization's privacy risk management program?

Answer: To advise on and monitor compliance with data protection laws and serve as a contact point for supervisory authorities

Under GDPR Article 39, the DPO's tasks include informing and advising the controller and processors, monitoring compliance, advising on DPIAs, and cooperating with supervisory authorities.