CIPT Privacy Program Implementation and Operations 3

Question 1

What is the primary purpose of a 'privacy by default' operational setting in a product or service?

Accepted Answer

Ensure the most privacy-protective settings are active without any user action required

Answer

Make all data publicly accessible unless users opt out

Answer

Disable all non-essential features on launch

Answer

Apply maximum data collection as the baseline

Question 2

Which international standard provides a framework for privacy information management systems (PIMS) and can be used to certify an organization's privacy program?

Accepted Answer

ISO/IEC 27701

Answer

ISO 9001

Answer

ISO/IEC 27001

Answer

NIST SP 800-53

Question 3

A company's privacy team conducts an internal 'privacy audit' annually. What does this audit primarily assess?

Accepted Answer

Whether privacy controls are operating effectively and practices align with stated policies and applicable regulations

Answer

The number of privacy complaints received that year

Answer

The cost-effectiveness of privacy technology investments

Answer

Whether the privacy policy document has been updated

Question 4

Which NIST framework provides voluntary guidance for organizations to improve their privacy risk management programs?

Accepted Answer

NIST Privacy Framework (PF) 1.0

Answer

NIST Cybersecurity Framework (CSF) 2.0

Answer

NIST SP 800-171

Answer

NIST SP 800-37

Question 5

What is a 'privacy champion' network within an organization?

Accepted Answer

Designated employees embedded in business units who advocate for privacy practices and serve as liaisons to the central privacy team

Answer

External privacy consultants hired for annual reviews

Answer

A regulatory body that champions consumer privacy rights

Answer

Software agents that enforce data access policies automatically

Question 6

When a privacy program is described as operating at a 'repeatable' maturity level, what does this mean?

Accepted Answer

Privacy processes are documented and consistently followed, but not yet optimized or formally measured

Answer

Privacy is handled ad-hoc with no consistent processes

Answer

Privacy processes are fully automated and continuously improved

Answer

Privacy is only addressed in response to regulatory audits