CMO Data Security & Privacy Management Flashcards

What is the principle of least privilege as it applies to Mobilyze operator accounts?

Answer: Users are granted only the minimum access rights necessary to perform their job functions

The principle of least privilege limits each operator's access to only what is required for their role, reducing the attack surface.

Which of the following best describes data masking in the context of Mobilyze reporting?

Answer: Obscuring sensitive fields (e.g., client IDs) in reports shared outside the authorized team

Data masking replaces sensitive values with obscured equivalents so that reports can be shared safely without exposing confidential information.

What should a CMO operator do if they receive an email requesting their Mobilyze login credentials?

Answer: Ignore or delete the email and report it as a phishing attempt

Requests for credentials via email are characteristic of phishing attacks and should be reported rather than acted upon.

When field data contains personally identifiable information (PII), what additional safeguard is required during storage?

Answer: Encrypting PII at rest and restricting access to authorized personnel

PII must be encrypted at rest and access-controlled to comply with US privacy regulations and protect individuals' data.

What action should be taken if a Mobilyze device is lost or stolen in the field?

Answer: Immediately report it, remotely wipe if possible, and revoke associated credentials

Prompt reporting and remote wiping of a lost device minimizes the risk of unauthorized data access from the stolen hardware.

Which US regulation most directly governs the handling of personally identifiable information collected during Mobilyze field operations involving government clients?

Answer: FISMA

FISMA (Federal Information Security Modernization Act) sets the security standards for handling data collected during operations with US federal government clients.