support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. IAPP
  4. CIPM

IAPP CIPM Exam Prep
Certified Information Privacy Manager (Page 5 )

Updated On: 21-Sep-2026
Page 5 of 47
PDF with 361 Questions

SCENARIO -Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. Richard believes that a transition from the use of fax machine to Internet faxing provides all of the following security benefits EXCEPT?

  1. Greater accessibility to the faxes at an off-site location.
  2. The ability to encrypt the transmitted faxes through a secure server.
  3. Reduction of the risk of data being seen or copied by unauthorized personnel.
  4. The ability to store faxes electronically, either on the user's PC or a password-protected network server.

Answer(s): A

Explanation:

Why option A is the exception
Greater accessibility to the faxes at an off-site location – This describes a convenience feature, not a security benefit. In fact, making faxes accessible remotely can increase exposure risk if the remote access is not strictly controlled. All other listed features directly address confidentiality, integrity, or reduced exposure of personal data:
1. Encryption of transmitted faxes through a secure server – Data are protected in-transit, preventing interception. 2. Reduction of the risk of data being seen or copied by unauthorized personnel – Centralized,
authenticated printing limits physical exposure. 3. Ability to store faxes electronically on a password-protected server or PC – Electronic storage enables access controls, audit trails, and encryption at rest.
Why the other options are appropriate security benefits
Encryption ensures that even if the fax signal is captured, it remains unreadable without the proper key. Limiting physical visibility eliminates the chance that a third party walking by the copier or printer can view sensitive documents. Electronic, password-protected storage allows the organization to enforce role-based access, retain logs for compliance, and apply encryption to stored files, thereby strengthening data protection overall.


Reference:

NIST SP 800-53 Rev. 5 – Security and Privacy Controls for Information Systems and Organizations (Section AU-6: Audit Monitoring and Control; Section SC-13: Cryptographic Protection) – https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ISO/IEC 27001:2013 – Information security management systems – Requirements (Annex A.10.1: Cryptographic controls; Annex A.9.2: User access management) – https://www.iso.org/standard/54534.html
These sources outline the technical controls that underpin the security advantages of moving from traditional fax to an Internet-based, encrypted fax solution.



SCENARIO -Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. As Richard begins to research more about Data Lifecycle Management (DLM), he discovers that the law office can lower the risk of a data breach by doing what?

  1. Prioritizing the data by order of importance.
  2. Minimizing the time it takes to retrieve the sensitive data.
  3. Reducing the volume and the type of data that is stored in its system.
  4. Increasing the number of experienced staff to code and categorize the incoming data.

Answer(s): C

Explanation:

Correct option: C – Reducing the volume and the type of data that is stored in its system
Risk-based justification – The most effective way to lower the probability of a breach is to limit the amount of sensitive data that exists within the organization’s control. By eliminating unnecessary collection, retention, or duplication of personally identifiable information (PII), the attack surface is reduced; fewer records mean fewer opportunities for unauthorized access, exfiltration, or accidental disclosure. Data-lifecycle alignment – In Data Lifecycle Management, each stage (collection, use, storage, retention, disposal) presents a distinct security surface. Reducing volume directly shortens the lifecycle, eliminating later stages that would otherwise require protection (e.g., archiving, backup, transmission). This complements controls such as encryption or access-rights management by removing data that would otherwise need those safeguards. Regulatory relevance – Many privacy statutes (e.g., GDPR, CCPA, HIPAA) emphasize data minimization as a principle of lawful processing. Implementing it can be demonstrated to regulators as a concrete, proactive measure, thereby mitigating potential enforcement exposure.
Why the other options are inferior
A – Prioritizing data by order of importance – Ranking data does not reduce the amount that must be protected; it merely determines handling priorities. The underlying volume of sensitive data remains unchanged, so the intrinsic breach risk stays high. B – Minimizing retrieval time for sensitive data – Faster access can improve operational efficiency but does not diminish the quantity of data stored. An attacker who gains entry still encounters the same pool of data, offering no additional security benefit. D – Increasing staff to code and categorize data – Adding personnel may improve metadata management but introduces additional human factors (training, turnover) and does not inherently lower the data footprint. Moreover, staffing increases cost and complexity without directly addressing the fundamental privacy-risk driver.


Reference:

International Association of Privacy Professionals (IAPP) – Data Minimization and Its Role in Privacy Programs https://iapp.org/resources/article/data-minimization-and-its-role-in-privacy-programs/
NIST Special Publication 800-53 Revision 5 – Privacy Controls for Federal Information Systems and Organizations (Section PL-1: Data Minimization) https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
These sources detail how reducing data volume is the primary technical lever for lowering breach risk within
Data Lifecycle Management frameworks.



SCENARIO -Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed.
Which of the following policy statements needs additional instructions in order to further protect the personal data of their clients?

  1. All faxes sent from the office must be documented and the phone number used must be double checked to ensure a safe arrival.
  2. All unused copies, prints, and faxes must be discarded in a designated recycling bin located near the work station and emptied daily.
  3. Before any copiers, printers, or fax machines are replaced or resold, the hard drives of these devices must be deleted before leaving the office.
  4. When sending a print job containing personal data, the user must not leave the information visible on the computer screen following the print command and must retrieve the printed document immediately.

Answer(s): B

Explanation:

Why option B requires additional instructional detail
The statement “All unused copies, prints, and faxes must be discarded in a designated recycling bin located near the work station and emptied daily.” addresses disposal but it does not prescribe a secure method for handling personal data. Without explicit direction to shred or otherwise render the data unrecoverable before disposal, sensitive information could remain accessible on the recycled material, creating a leakage risk. Therefore, the policy should be supplemented with instructions such as: • All printed or faxed documents containing PII/PHI must be cross-shredded or placed in a locked, HIPAA-compliant disposal container. • The container must be emptied by authorized personnel at the end of each business day and the shredded material must be stored securely until it is destroyed by a certified waste-management provider.
Why the other options are already sufficient or do not need further clarification
Option A – Requiring documentation of each fax and double-checking the destination number establishes a clear procedural safeguard that protects data in transit; no extra steps are necessary beyond confirming the destination. Option C – Mandating destruction of hard-drive data before disposal is a recognized security control (e.g., NIST 800-88) and already provides a complete instruction set; the only needed follow-up is verification of the destruction method, which can be covered in the existing policy wording. Option D – Stating that users must not leave printed material visible on screen and must retrieve it immediately directly enforces a “clean-desk” practice that eliminates exposure; the required actions are explicit and do not need additional granularity.
Hence, option B is the only policy statement that lacks the necessary security-focused disposal instruction to fully safeguard personal data, making it the correct answer.


Reference:

National Institute of Standards and Technology (NIST) Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final (see Control PL-2 – “Disposal”). International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 27001:2022, Information security management systems – Requirements: https://www.iso.org/standard/75664.html (see Annex A.12.6 – “Secure disposal of used media”).



SCENARIO -Please use the following to answer the next question: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all of their basic networking needs. He plans to hire more employees once Richard gets settled and assesses the office's strategies for growth. Immediately upon arrival, Richard was amazed at the amount of work that needed to done in order to modernize the office, mostly in regard to the handling of clients' personal data. His first goal is to digitize all the records kept in file cabinets, as many of the documents contain personally identifiable financial and medical data. Also, Richard has noticed the massive amount of copying by the administrative assistant throughout the day, a practice that not only adds daily to the number of files in the file cabinets, but may create security issues unless a formal policy is firmly in place Richard is also concerned with the overuse of the communal copier/printer located in plain view of clients who frequent the building. Yet another area of concern is the use of the same fax machine by all of the employees. Richard hopes to reduce its use dramatically in order to ensure that personal data receives the utmost security and protection, and eventually move toward a strict Internet faxing policy by the year's end. Richard expressed his concerns to his grandfather, who agreed, that updating data storage, data security, and an overall approach to increasing the protection of personal data in all facets is necessary Mr. McAdams granted him the freedom and authority to do so. Now Richard is not only beginning a career as an attorney, but also functioning as the privacy officer of the small firm. Richard plans to meet with the IT employee the following day, to get insight into how the office computer system is currently set-up and managed. Richard needs to closely monitor the vendor in charge of creating the firm's database mainly because of what?

  1. The vendor will be required to report any privacy violations to the appropriate authorities.
  2. The vendor may not be aware of the privacy implications involved in the project.
  3. The vendor may not be forthcoming about the vulnerabilities of the database.
  4. The vendor will be in direct contact with all of the law firm's personal data.

Answer(s): B

Explanation:

Why option B is the best answer
The vendor’s contractual focus is typically on delivering the technical solution; they may lack specific privacy expertise or a privacy-by-design mindset. Without active oversight, the vendor might overlook statutory obligations (e.g., handling of PII, breach-notification duties) or fail to embed appropriate safeguards from the outset. Monitoring is therefore required to surface and remediate any gaps in the vendor’s understanding of the privacy impact before the database goes live.
Why the other options are less appropriate
A – “The vendor will be required to report any privacy violations to the appropriate authorities.” Reporting obligations normally fall on the data controller (the law firm), not on the vendor. The vendor’s reporting duty is not the primary reason for close monitoring.
C – “The vendor may not be forthcoming about the vulnerabilities of the database.” While disclosure of vulnerabilities is important, the more fundamental concern is the vendor’s overall awareness of privacy implications. Lack of transparency is a symptom of that broader unawareness, not the core justification.
D – “The vendor will be in direct contact with all of the law firm's personal data.” Direct contact with data is a technical detail; the key issue for a privacy officer is ensuring the vendor comprehends and respects privacy requirements, regardless of the exact point of contact.


Reference:

NIST SP 800-53 Rev. 5 – Security and Privacy Controls for Information Systems and Organizations – Provides guidance on vendor management and privacy impact assessments. https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ISO/IEC 27701:2019 – Privacy Information Management System (PIMS) Requirements and Guidelines – Outlines responsibilities for controllers and processors, emphasizing the need to monitor third-party processors for privacy compliance. https://www.iso.org/standard/74333.html



What should be the first major goal of a company developing a new privacy program?

  1. To survey potential funding sources for privacy team resources.
  2. To schedule conversations with executives of affected departments.
  3. To identify potential third-party processors of the organization's information.
  4. To create Data Lifecycle Management policies and procedures to limit data collection.

Answer(s): B

Explanation:

Justification
Option B – “To schedule conversations with executives of affected departments.”
Strategic alignment: The foundational step in launching a privacy program is securing executive sponsorship and understanding the organization’s risk appetite. Engaging senior leaders first ensures that the necessary authority, resources, and governance structure are in place before any technical or procedural work begins. Risk-based focus: Executives can identify which business units handle personal or sensitive data, allowing the privacy team to prioritize high-impact areas from the outset. Common practice: Privacy frameworks (e.g., ISO 27701, NIST Privacy Framework) prescribe that the initial phase involves stakeholder engagement and governance chartering, which starts with executive conversations.
Why the other options are less suitable as the first major goal
Option A – Surveying funding sources is premature; funding decisions depend on a defined scope and governance model, which cannot be finalized before executive buy-in. Option C – Identifying third-party processors assumes the organization already knows its data flows and external relationships, which typically emerge only after an initial inventory and governance framework are established. Option D – Creating Data Lifecycle Management policies is an important technical activity, but it requires prior clarification of the program’s scope, authority, and risk priorities—elements that can only be obtained through executive engagement.
Conclusion The first major goal should be to schedule conversations with executives of affected departments (Option B). This establishes governance, secures resources, and aligns privacy objectives with business priorities, creating a solid foundation for subsequent activities such as funding, third-party mapping, and policy development.


Reference:

ISO/IEC 27701:2019 – Privacy Extension to ISO/IEC 27001, Clause 5.3 “Leadership and commitment”. NIST Privacy Framework – “Core” function emphasizes “Governance” and “Risk Management” activities that begin with stakeholder engagement. ( https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ) IAPP Certified Information Privacy Manager (CIPM) Official Exam Syllabus, Module 1: “Foundations of Privacy”. ( https://iapp.org/certification/cipm/exam-prep/ )



Which is TRUE about the scope and authority of data protection oversight authorities?

  1. The Office of the Privacy Commissioner (OPC) of Canada has the right to impose financial sanctions on violators.
  2. All authority in the European Union rests with the Data Protection Commission (DPC).
  3. No one agency officially oversees the enforcement of privacy regulations in the United States.
  4. The Asia-Pacific Economic Cooperation (APEC) Privacy Frameworks require all member nations to designate a national data protection authority.

Answer(s): C

Explanation:

Correct answer – C. “No one agency officially oversees the enforcement of privacy regulations in the United States.”
In the U.S. privacy landscape, enforcement is fragmented across multiple sector-specific federal agencies
(e.g., FTC, HHS, DOJ, CFPB) and state regulators. No single authority has nationwide, comprehensive jurisdiction to enforce all privacy statutes, making this statement accurate.
Why the other options are incorrect

A: The Office of the Privacy Commissioner of Canada does not have the power to impose financial sanctions; it can investigate, report, and refer matters to the Federal Court, which then may levy penalties. Its enforcement tools are advisory and remedial rather than directly sanctioning. B. In the EU, the data-protection oversight is performed by a network of national supervisory authorities, not a single “Data Protection Commission.” While the European Data Protection Board coordinates them, enforcement responsibility is decentralized, so the claim that all authority rests with one DPC is false. D. The APEC Privacy Frameworks are voluntary, cross-border privacy principles; they do not mandate that member economies designate a single national authority. Each economy may appoint its own competent body, but the frameworks do not impose a universal requirement for a designated authority across all members.
Conclusion: Option C correctly captures the structure of U.S. privacy enforcement, whereas A, B, and D mischaracterize the powers and organization of the respective privacy oversight bodies.


Reference:

Office of the Privacy Commissioner of Canada – Enforcement powers: https://www.priv.gc.ca/en/privacy-topics/enforcement/index.php U.S. Federal Trade Commission – Privacy and Data Security Enforcement: https://www.ftc.gov/enforcement/rules/privacy-and-security/sectors-ftc-enforcement-actions-privacy-and-security



What should a privacy professional keep in mind when selecting which metrics to collect?

  1. Metrics should be reported to the public.
  2. The number of metrics should be limited at first.
  3. Metrics should reveal strategies for increasing company earnings.
  4. A variety of metrics should be collected before determining their specific functions.

Answer(s): B

Explanation:

Justification
Option B – “The number of metrics should be limited at the first.”
Why it’s correct: Early-stage metric selection must focus on a few high-impact indicators that can be reliably measured, understood, and acted upon. Limiting the set avoids data overload, reduces analysis paralysis, and enables clear performance baselines before expanding the monitoring scope.
Why others are inferior:
A – Metrics should be reported to the public. Reporting frequency and audience depend on stakeholder needs; public disclosure is not a prerequisite for metric selection. C – Metrics should reveal strategies for increasing company earnings. Metrics serve privacy risk management as much as commercial outcomes; tying them solely to earnings can overlook privacy-specific performance signals.
D – A variety of metrics should be collected before determining their specific functions. Collecting a wide array upfront can lead to unnecessary complexity and dilute focus; functional definition should precede metric proliferation.
Therefore, Option B aligns with the principle of starting with a concise, purpose-driven metric set to ensure operational relevance and statistical robustness.


Reference:

ISO/IEC 27701:2019 – Privacy Information Management System – Guidance and Implementation (Section 4.3 defines key performance indicators for privacy). NIST Privacy Framework – Core Metrics (advises limiting initial metrics to focus on measurable outcomes, https://www.nist.gov/cyberframework/privacy-framework ).



SCENARIO -Please use the following to answer the next question: Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow. With the expansion, Amira and Sadie have received advice from new senior staff members brought on to help manage the company's growth. One recent suggestion has been to combine the legal and security functions of the company to ensure observance of privacy laws and the company's own privacy policy. This sounds overly complicated to Amira, who wants departments to be able to use, collect, store, and dispose of customer data in ways that will best suit their needs. She does not want administrative oversight and complex structuring to get in the way of people doing innovative work. Sadie has a similar outlook. The new Chief Information Officer (CIO) has proposed what Sadie believes is an unnecessarily long timetable for designing a new privacy program. She has assured him that NatGen will use the best possible equipment for electronic storage of customer and employee data. She simply needs a list of equipment and an estimate of its cost. But the CIO insists that many issues are necessary to consider before the company gets to that stage. Regardless, Sadie and Amira insist on giving employees space to do their jobs. Both CEOs want to entrust the monitoring of employee policy compliance to low-level managers. Amira and Sadie believe these managers can adjust the company privacy policy according to what works best for their particular departments. NatGen's CEOs know that flexible interpretations of the privacy policy in the name of promoting green energy would be highly unlikely to raise any concerns with their customer base, as long as the data is always used in course of normal business activities. Perhaps what has been most perplexing to Sadie and Amira has been the CIO's recommendation to institute a privacy compliance hotline. Sadie and Amira have relented on this point, but they hope to compromise by allowing employees to take turns handling reports of privacy policy violations. The implementation will be easy because the employees need no special preparation. They will simply have to document any concerns they hear. Sadie and Amira are aware that it will be challenging to stay true to their principles and guard against corporate culture strangling creativity and employee morale. They hope that all senior staff will see the benefit of trying a unique approach.
What Data Lifecycle Management (DLM) principle should the company follow if they end up allowing departments to interpret the privacy policy differently?

  1. Prove the authenticity of the company's records.
  2. Arrange for official credentials for staff members.
  3. Adequately document reasons for inconsistencies.
  4. Create categories to reflect degrees of data importance.

Answer(s): C

Explanation:

Why option C is the correct principle
Consistent accountability – When different departments interpret the privacy policy in their own way, the organization must be able to explain why those deviations occur. Documenting the rationale provides a traceable audit trail that demonstrates compliance with legal and internal requirements. Risk mitigation – Explicit documentation captures the business justification (e.g., specific data-handling needs of a department) and the mitigating controls that were applied. This makes it possible to assess whether the departures remain within acceptable risk limits. Regulatory alignment – Many privacy regulations (e.g., GDPR Art. 5(2), CCPA) expect organizations to maintain records that justify processing activities. Maintaining such records fulfills the “document reasons for inconsistencies” requirement of Data Lifecycle Management (DLM).
Why the other options are less suitable

A: Prove the authenticity of the company's records – Authenticity is important for records integrity, but it does not address the core issue of differing policy interpretations; it is a separate DLM concern focused on evidential reliability rather than justification. B. Arrange for official credentials for staff members – Credentialing relates to access control and role-based permissions.
While relevant to security, it does not provide a mechanism for explaining why department-specific policy applications differ. D. Create categories to reflect degrees of data importance – Classification helps prioritize handling of data based on sensitivity, but it does not resolve the need to record why each department’s handling deviates from a central policy. Classification is orthogonal to the documentation of inconsistencies.
Thus, the DLM principle that directly supports flexible yet accountable policy application is “Adequately document reasons for inconsistencies.”


Reference:

ISO/IEC 27001:2022 – Information security controls : https://www.iso.org/standard/75666.html (covers documentation of risk treatment and justification) NIST Special Publication 800-53 Rev. 5 – Security and Privacy Controls : https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final (includes controls for accountability and justification of processing)



  PDF
Viewing page 5 of 47
Viewing questions 33 - 40 out of 361 questions


Post your Comments and Discuss IAPP CIPM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!