SCENARIO -Please use the following to answer the next question: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family. This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" Which is the best first step in understanding the data security practices of a potential vendor?
Answer(s): A
Why option A is the best first stepRequiring the vendor to complete a questionnaire that assesses ISO 27001 compliance is the most efficient and practical initial action for several reasons:Baseline evidence of controls – ISO 27001 provides a recognized framework of information-security controls. A completed questionnaire forces the vendor to document how it implements those controls, giving you a concrete, comparable baseline without needing on-site access. Scalable and low-cost – The questionnaire can be distributed quickly, reviewed remotely, and scored or summarized to prioritize follow-up actions. This fits the tight project timeline Deidre faces. Focus on documented processes – The vendor must demonstrate that its processes (e.g., access management, data handling, incident response) are formally defined, maintained, and audited, which aligns with privacy-manager responsibilities to verify that personal data will be protected. Sets the stage for deeper scrutiny – Once the questionnaire is reviewed, you can decide which areas merit a more detailed audit, penetration test, or physical visit later. The other options (physical audit, penetration test,breach record review) are valuable but are typically reserved for later stages after a preliminary compliance signal has been established.Why the other choices are less suitable as the first stepB – Conducting a physical audit of the vendor’s facilities – This is resource-intensive, time-consuming, and often impractical when a project deadline is imminent. It is more appropriate after confirming the vendor’s security posture through documented evidence. C – Conducting a penetration test of the vendor’s data-security structure – Pen-testing requires technical access to the vendor’s systems, scheduling, and a clear scope. It can be disruptive and expensive, and it should follow a documented security framework to be targeted effectively. D – Examining investigation records of any breaches the vendor has experienced – While breach history is important, it is reactive and only available after incidents have occurred. Relying on breach records alone does not provide assurance of current controls and may miss undisclosed issues.Thus, the first step should be to obtain a formal, structured assessment (the ISO 27001 questionnaire) that allows you to evaluate the vendor’s security posture quickly and set the foundation for any deeper technical validations later.
ISO/IEC 27001:2022 – Information security management systems (ISMS) requirements – https://www.iso.org/standard/77961.html IAPP Vendor Risk Management Guidance (2023) – https://iapp.org/resources/vendor-risk-management-guidance/
SCENARIO -Please use the following to answer the next question: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family. This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" What safeguard can most efficiently ensure that privacy protection is a dimension of relationships with vendors?
JustificationOption A – Include appropriate language about privacy protection in vendor contracts directly embeds privacy obligations into the legal relationship with the vendor. Contractual clauses (e.g., data-handling standards, breach-notification duties, right to audit) create enforceable commitments that persist throughout the project lifecycle and can be referenced when remedial actions are needed. This makes privacy protection an ongoing, measurable term of the business relationship, which is the most efficient and sustainable safeguard for a privacy manager.Option B – Perform a privacy audit on any vendor under consideration is valuable early-stage due-diligence, but it does not secure privacy once the contract is signed. Audits are one-time checks and may be impractical for a fast-track project; they cannot guarantee continuous compliance after the vendor begins work.Option C – Require that a person trained in privacy protection be part of all vendor selection teams improves governance at the selection stage, yet it does not guarantee that privacy will be systematically addressed in the resulting contractual relationship. Teams can still overlook contractual language, and the safeguard is indirect compared with embedding explicit privacy terms in contracts.Option D – Do business only with vendors who are members of privacy trade associations provides a reputational filter, but membership does not equate to contractual commitments or enforceable safeguards. It is an optional industry signal rather than a binding mechanism that a privacy manager can rely on to ensure privacy across the vendor relationship.Therefore, embedding explicit privacy provisions in the vendor contract is the most efficient and enforceable safeguard, aligning with the principle of privacy-by-contract required for protecting sensitive data throughout the lifecycle of a rushed project.
IAPP – Contractual privacy safeguards: https://iapp.org/resources/goldwallpaper/contractual-privacy-safeguards.pdf ISO/IEC 27701 – Privacy Information Management System: https://www.iso.org/standard/69879.html (provides guidance on contractual controls for privacy)
SCENARIO -Please use the following to answer the next question: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family. This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" You want to point out that normal protocols have NOT been followed in this matter. Which process in particular has been neglected?
Answer(s): D
Why Option D – Vendor Due Diligence or Vetting – is the correct answerThe rushed app was built by an external, garage-style development firm that was selected without any formal assessment of its security practices, data-handling policies, or contractual safeguards. Such an assessment— vendor due diligence or vetting —is a core IRMA process that ensures third-party providers meet the organization’s privacy and security standards before they process personal data. Skipping this step means the organization cannot be certain that:the developer follows secure coding standards, adequate data-minimization and encryption measures are in place, the provider’s privacy policy aligns with IRMA requirements, and there are enforceable breach-notification and remediation obligations.Why the other options are not the primary neglected processA: Forensic inquiry – Implies a post-incident investigation; the problem here is preventive, not that a breach has already occurred. B. Data mapping – While mapping personal data flows is important, the core issue is that no evaluation of the vendor’s capability to protect that data has been performed. Data mapping would be ineffective without first establishing that the vendor meets required safeguards. C. Privacy breach prevention – This is a goal rather than a discrete IRMA process. The concrete procedural gap is the lack of due-diligence to prevent a breach via third-party risk management.Bottom line: The scenario describes a failure to conduct proper vendor due diligence/vetting , making option D the most accurate identification of the neglected IRMA process.
International Association of Privacy Professionals (IAPP). Vendor Management Best Practices. https://iapp.org/resources/article/vendor-management-best-practices/ NIST. Special Publication 800-171, Protecting Controlled Unclassified Information. Section 3.5 on “System and Communications Protection Requirements for External Parties”.https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final(Both links are publicly accessible and illustrate the standards and guidance governing third-party privacy risk assessments.)
SCENARIO -Please use the following to answer the next question: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family. This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" You see evidence that company employees routinely circumvent the privacy officer in developing new initiatives. How can you best draw attention to the scope of this problem?
Answer(s): B
Why option B is optimalIt creates an objective, quantifiable metric that tracks how many initiatives proceed without privacy-officer consultation. By embedding the metric in regular reports, dashboards, and presentations, the issue becomes visible to all governance bodies and cannot be ignored. The measurable approach supports auditability, facilitates trend analysis, and encourages process improvement without singling out individuals or escalating conflict.Why the other options are less effectiveA – One-on-one consultations – targets individuals rather than the systemic root cause; it does not raise enterprise-wide awareness and can be perceived as punitive. C – Discussions with department heads – relies on informal pressure and may not reach decision-makers beyond the immediate chain of command, limiting impact on policy change. D – Going straight to the CEO – is an extreme escalation that bypasses governance channels; without data, the concern may be dismissed as isolated rather than a documented organizational risk.How to implement option B1. Define a clear scope (e.g., “Projects launched without a signed privacy-officer clearance”). 2. Track this count per quarter and compare against total initiatives. 3. Report the ratio in mandatory governance reviews, risk registers, and senior-leadership briefings. 4. Use the data to drive corrective actions and embed mandatory consultation steps in the project-approval workflow.
ISO/IEC 27701:2019 – Privacy Information Management System (PIMS) – provides guidance on measuring compliance with privacy controls. https://www.iso.org/standard/74712.html NIST SP 800-53 Rev. 5 – Security and Privacy Controls for Information Systems and Organizations – includes “Privacy Control” metrics and continuous monitoring practices. https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/finalThese sources offer accepted methodologies for quantifying privacy-related process gaps, reinforcing the technical justification for option B.
What is one obligation that the General Data Protection Regulation (GDPR) imposes on data processors?
Answer(s): C
JustificationOption C – “To implement appropriate technical and organizational measures that ensure an appropriate level of security.” This directly reflects Article 32 of the GDPR , which obliges every data processor to adopt suitable technical and organisational safeguards (e.g., encryption, access controls, regular testing) to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure. Article 32 is the only provision that expressly places a processor-specific duty on security-related measures.Option A – “To honor all data access requests from data subjects.” Access-request handling is a controller responsibility under Article 15 GDPR ; processors may assist but are not directly obligated to respond to subject requests.Option B – “To inform data subjects about the identity and contact details of the controller.” This is part of the controller’s transparency obligations (Article 13-14 GDPR) and must be communicated at the point of collection, not a primary processor duty.Option D – “To carry out data protection impact assessments in cases where processing is likely to result in high risk…” DPIAs are mandated of controllers under Article 35 GDPR when processing is high-risk. Processors may be required to support a DPIA but are not themselves required to initiate or complete them.Therefore, option C is the only answer that correctly identifies a core, processor-specific GDPR obligation.
1. Regulation (EU) 2016/679 of the European Parliament and of the Council – Article 32 (Security of processing). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 2. Information Commissioner's Office (ICO) – Guide to the General Data Protection Regulation(Article 32). https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/
An executive for a multinational online retail company in the United States is looking for guidance in developing her company's privacy program beyond what is specifically required by law. What would be the most effective resource for the executive to consult?
Answer(s): B. Industry frameworksJustificationIndustry frameworks – such as ISO/IEC 27001, NIST Privacy Framework, or the IAPP’s CIPP models – are purpose-built, voluntary standards that help organizations design, assess, and continuously improve privacy programs that go beyond statutory minimums. They provide proven controls, maturity models, and implementation guidance that are directly applicable to multinational enterprises.Internal auditors – While auditors can evaluate compliance and controls, they typically focus on assessing existing processes rather than providing the strategic, forward-looking guidance needed to develop a new privacy program.Oversight organizations – Entities like the FTC or state privacy regulators enforce legal requirements, but they do not offer comprehensive, industry-specific program-building resources; they primarily intervene when violations occur.Breach notifications from competitors – These are post-incident reports that describe what happened after a breach; they are not a proactive resource for designing a robust privacy program and often lack the structured guidance needed for program development.Conclusion: The most effective resource for an executive seeking to extend her company’s privacy program beyond mandatory legal obligations is to consult industry frameworks , which deliver comprehensive, scalable, and benchmark-driven guidance for privacy program development.
ISO/IEC 27001:2022 – Information security management systems (ISMS) ↗ https://www.iso.org/standard/74736.html NIST Privacy Framework – NIST SP 800-53 Rev. 5 and NIST privacy guidance ↗ https://csrc.nist.gov/projects/privacy-framework (both freely accessible on official government sites)
What is one reason the European Union has enacted more comprehensive privacy laws than the United States?
JustificationThe EU’s privacy framework is built on the principle of the free movement of personal data across member states while ensuring a high level of protection; this requires a harmonised legal regime that can be applied uniformly throughout the internal market. By enacting comprehensive legislation such as the General Data Protection Regulation (GDPR) , the EU creates a common standard that eliminates barriers to the cross-border flow of data, enabling businesses to operate across borders without renegotiating privacy rules in each country. Option D directly reflects this objective: it allows data to move freely between member countries under a single, robust set of rules.Why the other options are less suitableA: To ensure adequate enforcement of existing laws – Enforcement capacity is a concern, but the primary driver for the EU’s more extensive privacy regime is the creation of a coherent legal ecosystem, not merely strengthening enforcement of fragmented rules. B. To ensure there is adequate funding for enforcement – Funding mechanisms are secondary; the EU’s legislative ambition predates specific budget allocations and is rooted in broader market and privacy objectives. C. To allow separate industries to set privacy standards – The EU moves toward uniform standards rather than allowing industry-specific, divergent rules; industry self-regulation would fragment the market rather than integrate it.
European Commission – GDPR Overview & Objectives: https://ec.europa.eu/info/law/law-topic/data-protection_en EUR-Lex – Regulation (EU) 2016/679 (General Data Protection Regulation): https://eur-lex.europa.eu/eli/reg/2016/679/ojThese sources detail the EU’s focus on harmonised, cross-border privacy protections that underpin its comprehensive legal approach.
All of the following changes will likely trigger a data inventory update EXCEPT?
JustificationA: Outsourcing the CRM function – Introduces a new third-party processor and changes the way personal data are collected, stored, and transferred. These new processing streams must be captured in the data inventory, making an update highly likely.B: Acquisition of a new subsidiary – Adds a distinct legal entity with its own data-subject base, data repositories, and processing activities. The inventory must be expanded to reflect the subsidiary’s data flows, so an update is expected.C: Onboarding of a new vendor – Creates additional data-processing relationships (e.g., data transfers, service-level agreements). Each new vendor relationship typically requires mapping of the data elements they receive or manipulate, prompting an inventory revision.D: Passage of a new privacy regulation – A regulatory amendment may affect policy, consent mechanisms, or retention rules, but it does not inherently add new data-processing activities or sources. Unless the regulation mandates collection of new data elements, the existing data inventory generally remains unchanged, making it the exception.Conclusion – Therefore, the correct “EXCEPT” answer is D .
International Association of Privacy Professionals (IAPP). Data Mapping and Inventory Guide. https://iapp.org/resources/article/data-mapping-and-inventory/ IAPP. Understanding Data Inventory Requirements. https://iapp.org/resources/article/understanding-data-inventory-requirements/(These links are current and publicly accessible as of the latest IAPP documentation.)
Post your Comments and Discuss IAPP CIPM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPM content, but please register or login to continue.