SCENARIO -Please use the following to answer the next question: Hi Zoe, Thank you so much for your email. I am so glad you have jumped right into your new position as our in-house privacy professional. BastTech greatly needs your expertise. I hope you are comfortably settling into your new home in the United States after your move from the United Kingdom! Georgia is a wonderful state. I particularly appreciate your enthusiasm in using your recent informal assessment to begin rectifying gaps in our privacy program and making sure we are in compliance with all laws. However, I also want to make sure that we are prioritizing our initiatives by spending time on the measures that are most important to our customers, our company, and the tech industry as a whole. Specifically, I know that you are advocating for an update of our Business Continuity Disaster Response (BCDR) plan with an eye toward privacy concerns. I think this effort is something that we may be able to postpone. I'm sure that after ten years the document can be updated in spots; however, we have first-rate, experienced executive leaders that would have things well in hand in the unlikely event of a disaster. Further, you mentioned that you would like to assess our longtime subcontractor's disaster plan through a second-party audit. Papyrus, our longtime subcontractor, does keep a great deal of personal data about our customers. However, I am not sure I understand your request and would like to discuss this further during our meeting Wednesday.You also say that your audit uncovered some inadequacies in staff compliance with our security procedures and local laws. I just wanted to emphasize that the audit findings only need to be communicated to the executive leadership. I would rather not cause unnecessary alarm across departments. I know you are also looking closely at the recent loss of a file belonging to a staff member in Human Resources (HR). It was an unfortunate incident, but rest assured, we handled the situation according to Georgia state law. The only difficult part was easing the concerns of our many remote employees all across the country whose data was on the computer. But I believe everything is settled. At least this stands as proof that in the event of another breach of any type, Information Security (IS) will take the lead while other departments move on with business as usual without having to get involved. Thankfully, we have taken the measure of supplementing our General Commercial Liability Insurance with cyber insurance. Anyway, we will talk more on Wednesday. I just wanted to communicate some of my current thinking. Thanks, Whitney -Interim Assistant Business Manager, BastTech. Based on the email, what should Zoe suggest to Whitney regarding the informal audit?
Answer(s): D
Justification for Option D – Disseminate Audit Findings to Key PersonnelThe email makes clear that Whitney expects audit results to be confined to executive leadership and wants to avoid unnecessary alarm in other departments. In a privacy-centred program, “key personnel” are the individuals who possess the authority, responsibility, or need-to-know to act on privacy-related findings (e.g., senior management, the Chief Privacy Officer, and the Information Security lead).Why D is correct – Suggesting that the audit information be shared only with those who require it to mitigate risk or implement corrective actions aligns with privacy-principles of “minimum necessary use” and “need-to-know.” It also respects Whitney’s request to keep the broader organization calm while still enabling remediation. Why A is less suitable – Conducting multiple audits in rapid succession would fragment resources, duplicate effort, and increase operational cost without demonstrable privacy benefit. The scenario does not indicate a need for speed; rather, it stresses judicious prioritisation. Why B is less suitable – Making audit results public would expose sensitive assessment details, compromise confidentiality of findings, and could contravene contractual or regulatory confidentiality obligations (e.g., ISO 27001’s clause on “Protection of Confidentiality”). Public disclosure is unnecessary and could undermine stakeholder confidence. Why C is less suitable – Expanding the audit team without a defined governance model could dilute accountability and dilute the focus on the most critical findings. The email emphasizes a controlled, executive-level communication flow, not a broader audit-participation initiative.Thus, the most appropriate suggestion is to ensure the audit information is disseminated to the key personnel who can evaluate and act upon it , which directly maps to option D.
ISO/IEC 27001:2022 – Clause 5.3.2 – Information Security Policies – emphasizes protecting confidentiality of information and sharing it on a need-to-know basis. NIST Special Publication 800-53 Rev. 5 – Control AU-6: Audit Review, Analysis, and Reporting – requires that audit findings be communicated to appropriate personnel with defined authority.
SCENARIO -Please use the following to answer the next question: Hi Zoe, Thank you so much for your email. I am so glad you have jumped right into your new position as our in-house privacy professional. BastTech greatly needs your expertise. I hope you are comfortably settling into your new home in the United States after your move from the United Kingdom! Georgia is a wonderful state. I particularly appreciate your enthusiasm in using your recent informal assessment to begin rectifying gaps in our privacy program and making sure we are in compliance with all laws. However, I also want to make sure that we are prioritizing our initiatives by spending time on the measures that are most important to our customers, our company, and the tech industry as a whole. Specifically, I know that you are advocating for an update of our Business Continuity Disaster Response (BCDR) plan with an eye toward privacy concerns. I think this effort is something that we may be able to postpone. I'm sure that after ten years the document can be updated in spots; however, we have first-rate, experienced executive leaders that would have things well in hand in the unlikely event of a disaster. Further, you mentioned that you would like to assess our longtime subcontractor's disaster plan through a second-party audit. Papyrus, our longtime subcontractor, does keep a great deal of personal data about our customers. However, I am not sure I understand your request and would like to discuss this further during our meeting Wednesday. You also say that your audit uncovered some inadequacies in staff compliance with our security procedures and local laws. I just wanted to emphasize that the audit findings only need to be communicated to the executive leadership. I would rather not cause unnecessary alarm across departments. I know you are also looking closely at the recent loss of a file belonging to a staff member in Human Resources (HR). It was an unfortunate incident, but rest assured, we handled the situation according to Georgia state law. The only difficult part was easing the concerns of our many remote employees all across the country whose data was on the computer. But I believe everything is settled. At least this stands as proof that in the event of another breach of any type, Information Security (IS) will take the lead while other departments move on with business as usual without having to get involved. Thankfully, we have taken the measure of supplementing our General Commercial Liability Insurance with cyber insurance. Anyway, we will talk more on Wednesday. I just wanted to communicate some of my current thinking. Thanks, Whitney -Interim Assistant Business Manager, BastTech. Based on Whitney's thoughts about the lost file, in what area of privacy law does she have a misunderstanding?
Answer(s): B
Justification of the correct option (B – “The applicability of state laws”)Whitney states that the missing HR file “was handled according to Georgia state law ,” implying that compliance with the law was automatically satisfied. However, privacy incidents involving employee data may also be subject to federal privacy statutes (e.g., the Genetic Information Nondiscrimination Act , Americans with Disabilities Act , or sector-specific mandates) and to contractual obligations that impose additional requirements beyond state law. By focusing solely on Georgia law, she overlooks the broader applicability of other jurisdictional regimes (including federal privacy rules) that could affect breach reporting, notification, and remediation. This is the specific area of misunderstanding.Why the other options are unsuitableA – Scope of federal law : While federal law does play a role, the misconception centers on the pre-emptive assumption that state law alone governs the situation, not on the breadth of federal regulation. C – Requirements under Georgia state law : Whitney actually demonstrates an understanding of Georgia law, so there is no evident misunderstanding here. D – Applicability of HIPAA on employee data : HIPAA applies only to protected health information held by covered entities or their business associates; employee personnel records are generally not covered. This is not the core of her error.Thus, the key misunderstanding is the belief that state law alone governs the incident , ignoring the possible overlap with federal and contractual privacy obligations.
International Association of Privacy Professionals (IAPP) – Privacy Law Overview – https://iapp.org/resources/privacy-law-overview/ U.S. Department of Health & Human Services – HIPAA Privacy Rule – https://www.hhs.gov/hipaa/for-individuals/index.html (illustrates the limited scope of HIPAA)
SCENARIO -Please use the following to answer the next question: Hi Zoe, Thank you so much for your email. I am so glad you have jumped right into your new position as our in-house privacy professional. BastTech greatly needs your expertise. I hope you are comfortably settling into your new home in the United States after your move from the United Kingdom! Georgia is a wonderful state. I particularly appreciate your enthusiasm in using your recent informal assessment to begin rectifying gaps in our privacy program and making sure we are in compliance with all laws. However, I also want to make sure that we are prioritizing our initiatives by spending time on the measures that are most important to our customers, our company, and the tech industry as a whole. Specifically, I know that you are advocating for an update of our Business Continuity Disaster Response (BCDR) plan with an eye toward privacy concerns. I think this effort is something that we may be able to postpone. I'm sure that after ten years the document can be updated in spots; however, we have first-rate, experienced executive leaders that would have things well in hand in the unlikely event of a disaster. Further, you mentioned that you would like to assess our longtime subcontractor's disaster plan through a second-party audit. Papyrus, our longtime subcontractor, does keep a great deal of personal data about our customers. However, I am not sure I understand your request and would like to discuss this further during our meeting Wednesday. You also say that your audit uncovered some inadequacies in staff compliance with our security procedures and local laws. I just wanted to emphasize that the audit findings only need to be communicated to the executive leadership. I would rather not cause unnecessary alarm across departments. I know you are also looking closely at the recent loss of a file belonging to a staff member in Human Resources (HR). It was an unfortunate incident, but rest assured, we handled the situation according to Georgia state law. The only difficult part was easing the concerns of our many remote employees all across the country whose data was on the computer. But I believe everything is settled. At least this stands as proof that in the event of another breach of any type, Information Security (IS) will take the lead while other departments move on with business as usual without having to get involved. Thankfully, we have taken the measure of supplementing our General Commercial Liability Insurance with cyber insurance. Anyway, we will talk more on Wednesday. I just wanted to communicate some of my current thinking. Thanks, Whitney -Interim Assistant Business Manager, BastTech. To better respond to privacy incidents, Whitney should consider making better use of what?
Why option D is the best choiceStakeholder role clarity directly improves incident response by defining who does what when a privacy breach occurs, ensuring timely escalation, coordinated investigation, and appropriate communication across legal, IT, HR, and executive teams. The scenario shows confusion about “who should take the lead” (IS) and “who should be notified” (executive leadership only). Making stakeholder responsibilities explicit resolves this ambiguity and supports a systematic, measured approach to privacy incidents. Frameworks (option A) are useful governance tools, but without clearly assigned roles they remain abstract; training outside the company (option B) adds knowledge but does not address the immediate coordination gap; data-amendment protocols (option C) pertain to data-subject rights, not to incident handling.Therefore, enhancing the use of roles of stakeholders across departments aligns with privacy-incident management best practices and will enable Whitney to respond more effectively.Why the other options are less suitableA – An appropriate industry framework: Frameworks provide guidance but do not resolve the current breakdown in cross-departmental responsibility. B – Training offered outside the company: External training may increase awareness, yet the immediate need is internal role definition to manage incidents promptly. C – Protocols for amending personal data: These address data correction workflows, not the orchestration of incident detection, containment, and reporting.
NIST Special Publication 800-61 Rev. 2 – Computer Security Incident Handling Guide : https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035-1:2016 – Information security incident management – Guidelines for incident management : https://www.iso.org/standard/63766.html
SCENARIO -Please use the following to answer the next question: Hi Zoe, Thank you so much for your email. I am so glad you have jumped right into your new position as our in-house privacy professional. BastTech greatly needs your expertise. I hope you are comfortably settling into your new home in the United States after your move from the United Kingdom! Georgia is a wonderful state. I particularly appreciate your enthusiasm in using your recent informal assessment to begin rectifying gaps in our privacy program and making sure we are in compliance with all laws. However, I also want to make sure that we are prioritizing our initiatives by spending time on the measures that are most important to our customers, our company, and the tech industry as a whole. Specifically, I know that you are advocating for an update of our Business Continuity Disaster Response (BCDR) plan with an eye toward privacy concerns. I think this effort is something that we may be able to postpone. I'm sure that after ten years the document can be updated in spots; however, we have first-rate, experienced executive leaders that would have things well in hand in the unlikely event of a disaster. Further, you mentioned that you would like to assess our longtime subcontractor's disaster plan through a second-party audit. Papyrus, our longtime subcontractor, does keep a great deal of personal data about our customers. However, I am not sure I understand your request and would like to discuss this further during our meetingWednesday. You also say that your audit uncovered some inadequacies in staff compliance with our security procedures and local laws. I just wanted to emphasize that the audit findings only need to be communicated to the executive leadership. I would rather not cause unnecessary alarm across departments. I know you are also looking closely at the recent loss of a file belonging to a staff member in Human Resources (HR). It was an unfortunate incident, but rest assured, we handled the situation according to Georgia state law. The only difficult part was easing the concerns of our many remote employees all across the country whose data was on the computer. But I believe everything is settled. At least this stands as proof that in the event of another breach of any type, Information Security (IS) will take the lead while other departments move on with business as usual without having to get involved. Thankfully, we have taken the measure of supplementing our General Commercial Liability Insurance with cyber insurance. Anyway, we will talk more on Wednesday. I just wanted to communicate some of my current thinking. Thanks, Whitney -Interim Assistant Business Manager, BastTech. Based on the email, Zoe is most likely to praise Whitney for what?
Answer(s): C
Why option C – “Anticipating potential financial impacts” – is the best answerWhitney repeatedly frames her commentary around the cost and risk of the initiatives Zoe proposes. She argues that updating the BCDR plan can be postponed because the company already has “first-rate, experienced executive leaders” who can handle a disaster, implicitly weighing the financial burden of an unnecessary overhaul against operational continuity. She also downplays the significance of audit findings, stressing that they should only be communicated to executives to avoid “unnecessary alarm,” which shows she is focused on preventing financial fallout from unnecessary departmental disruptions. By emphasizing that incidents were “handled according to Georgia state law” and that “cyber insurance” has been added, she demonstrates an awareness of how privacy incidents can translate into financial exposure and that mitigation strategies must be financially defensible.Why the other options are less suitableA: Knowing the business well – The email does not showcase Zoe praising Whitney for her depth of business knowledge; rather, Whitney is instructing Zoe on what not to prioritize. No explicit reference is made to business-knowledge expertise. B. Making consumers a priority – Whitney’s tone actually de-emphasizes consumer-centric privacy actions (e.g., she suggests postponing BCDR updates and limits the scope of audits), indicating that she does not view consumer-first privacy work as a point of praise. D. Prioritizing the privacy tasks that Zoe should focus on – Whitney directly counters Zoe’s push to prioritize privacy-related projects, telling her that those initiatives can be delayed. Thus, Zoe would not praise Whitney for encouraging those specific privacy tasks.Conclusion The only choice that aligns with Whitney’s demonstrated focus on fiscal risk management and cost-benefit reasoning is C. Anticipating potential financial impacts . This reflects the core of Whitney’s messaging— evaluating initiatives through a financial-impact lens rather than purely privacy or consumer-centric criteria.
NIST Privacy Framework, Section 3.1 – Risk Assessment and Management: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ISO/IEC 27701:2019 – Privacy Information Management System Requirements and Guidelines: https://www.iso.org/standard/75158.html
Which of the following changes typically does NOT require a Privacy Impact Assessment (PIA)?
Why option C is the only change that typically does NOT require a PIA-Updating a privacy notice to add a data-subject-access-request (DSAR) mechanism is a policy amendment , not a change to the technical or operational handling of personal data. A PIA assesses the privacy impact of how data is collected, processed, stored, or shared; merely publishing a new request option does not alter data flows, purposes, or risk levels. -All other options involve modifications that directly affect data flows, processing purpose, or security context , which are core triggers for a PIA: • Option A – A change in data volume can affect risk (e.g., larger datasets increase exposure, storage, and retention considerations). • Option B – New features that alter how data is accessed introduce new processing activities, possibly new purposes or access controls that need privacy risk evaluation. • Option D – Moving from an on-premise data center to a hosted cloud service changes the environment, potentially exposing data to different jurisdictions, security controls, and service-level agreements, all of which merit a PIA.Therefore, Option C is the correct answer because a privacy-policy update alone, without altering data processing, does not meet the typical criteria that necessitate a PIA.
International Association of Privacy Professionals (IAPP). What Is a Privacy Impact Assessment? https://iapp.org/resources/article/what-is-a-pia/ National Institute of Standards and Technology (NIST). NIST Privacy Framework. https://www.nist.gov/privacy/framework
A Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) are conducted during what phase of a System Development Life Cycle (SDLC)?
Correct option: B – Design phaseTiming of privacy analysis: PTA, PIA and DPIA are performed early in the SDLC to embed privacy considerations before any technical artefacts are built or deployed. This is when the system’s architecture, data flows, and functionality are first defined, allowing risks to be identified and mitigated proactively. Design as the optimal stage: The design stage (often called the “Design” or “System Design” phase) is explicitly geared toward modelling processes, documenting data collections, and mapping controls—tasks that are the core requirements of a PIA/DPIA. Conducting these assessments here ensures that privacy impacts are integrated into the design specifications rather than being retro-fitted later. Why the other phases are less suitable:Testing (A): By the time testing begins, the system architecture is already fixed; any privacy gaps discovered now are costly to remediate and may require redesign, making the earlier design stage preferable for proactive assessment. Deployment (C): Deployment marks the point of production release; performing a DPIA then defeats its purpose of informing design decisions and can lead to non-compliant implementations. Maintenance (D): Maintenance addresses operational issues after launch; relying on a DPIA at this stage is too late to influence architectural choices and primarily serves compliance reporting rather than risk prevention.
Information Commissioner’s Office (ICO), Guide to Data Protection – Mapping Data Protection (2023) – https://ico.org.uk/for-organisations/guide-to-data-protection/mapping-data-protection/ European Union GDPR Portal, Article 35 – Data Protection Impact Assessments (2024) – https://gdpr.eu/article-35-data-protection-impact-assessments/
Which privacy principles and guidelines helped form the basis for the EU Data Protection Directive and The General Data Protection Regulation (GDPR)?
Correct option: D – OECD Privacy GuidelinesThe 1980 OECD Recommendations on the Protection of Privacy and Trans-border Flows of Personal Data first articulated core principles such as data minimization, purpose limitation, and data subject rights. These principles were explicitly adopted and refined in the EU Data Protection Directive (1995) and later codified into the GDPR. The OECD framework provided the international benchmark that the European legislator used to harmonize national regimes and to negotiate adequacy decisions, making it the foundational source for EU privacy law.Why the other options are unsuitableA – Canadian Standards Association (CSA) Privacy Code – Though influential within Canada, the CSA code was published after the OECD guidelines and did not shape the drafting of EU legislation. B – ETSI (European Telecommunications Standards Institute) – ETSI focuses on technical standards for information and communication technologies; its outputs are complementary to privacy regulation but were not a primary basis for the GDPR’s substantive principles. C – APEC Privacy Framework – The APEC Cross-Border Privacy Rules address regional data-flow practices in the Asia-Pacific; they emerged later and do not underpin the EU legal regime.
OECD Recommendations on the Protection of Privacy and Trans-border Flows of Personal Data (1980): https://data.oecd.org/privacy/oecd-privacy-guidelines.htm Official text of the GDPR (EUR-LEX): https://eur-lex.europa.eu/legal-content/EN/TXT/? uri=CELEX%3A32016R0679
Protection from threats to facilities, systems that process and store electronic copies, and IT work/equipment locations best describes which category of security control?
Answer(s): A
JustificationThe question describes safeguards that protect the physical environment where information systems are installed – e.g., locked server rooms, restricted access to data-centers, fire suppression, and power backup. These measures are classified in major privacy-security control frameworks (e.g., NIST SP 800-53 Control CA-1, ISO/IEC 27001 Annex A.12.1) as Physical Controls because they primarily address the security of the premises and infrastructure. Technical Controls focus on software, data, and processing mechanisms (e.g., encryption, access-control lists). Geographic Controls are not a standard category in typical privacy-security taxonomies; they pertain more to data residency or jurisdiction rather than physical facility protection. Administrative Controls involve policies, procedures, and personnel actions (e.g., security awareness training). While they can govern physical-security programs, the controls themselves are not the physical mechanisms.Therefore, the description aligns best with Physical Control .
NIST SP 800-53 Rev. 5 – Security and Privacy Controls for Federal Information Systems and Organizations: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ISO/IEC 27001:2022 – Information security management systems – Annex A controls: https://www.iso.org/standard/54534.html
Post your Comments and Discuss IAPP CIPM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPM content, but please register or login to continue.