Is CIPM Difficult?

The CIPM certification is a highly respected credential in the field of information privacy management. It is offered by the International Association of Privacy Professionals (IAPP) and is designed to assess an individual's knowledge and skills in this specialized domain.

The CIPM exam is known for its challenging nature, covering a wide range of topics related to privacy law, regulations, and best practices. Candidates must demonstrate a thorough understanding of data protection principles, data governance, risk management, and incident response to pass the exam.

To prepare for the CIPM exam, it is highly recommended to utilize the IAPP's official CIPM Practice Exam as a valuable study tool. This practice exam provides candidates with an opportunity to test their knowledge and identify areas that require further study. By leveraging this resource, candidates can increase their chances of success in obtaining the prestigious CIPM certification.

What is The Pass Rate For the CIPM Exam?

The pass rate for the Certified Information Privacy Manager (CIPM) exam varies depending on several factors, including the specific exam version and the preparation level of the candidates. According to the International Association of Privacy Professionals (IAPP), the overall pass rate for the CIPM exam is typically around 50%. This indicates that approximately half of the candidates who take the exam are successful in obtaining the certification.

To increase their chances of passing the CIPM exam, candidates are strongly encouraged to engage in thorough preparation. This includes studying the official IAPP study materials, attending training courses, and utilizing practice exams such as the CIPM Practice Exam. The CIPM Practice Exam is a valuable resource that allows candidates to assess their knowledge and identify areas that require further study. By leveraging this practice exam, candidates can gain a better understanding of the exam format and content.

How To Study For the CIPM Exam?

To effectively study for the Certified Information Privacy Manager (CIPM) exam, it is crucial to adopt a comprehensive and structured approach. Firstly, candidates should thoroughly review the official IAPP study materials, which provide a comprehensive overview of the exam topics. These materials cover a wide range of subjects, including privacy law, regulations, best practices, and emerging trends in information privacy management. In addition to studying the official materials, candidates may also consider attending training courses or workshops offered by the IAPP or other reputable organizations. These courses provide an opportunity to engage with experienced professionals and gain a deeper understanding of the exam content.

Furthermore, utilizing practice exams such as the CIPM Practice Exam is highly recommended. Practice exams allow candidates to test their knowledge, identify areas that require further study, and familiarise themselves with the exam format and question types. By combining these study methods and dedicating sufficient time and effort, candidates can increase their chances of success in obtaining the prestigious CIPM certification.

How Many Questions Are in the CIPM Exam?

The Certified Information Privacy Manager (CIPM) exam consists of 100 multiple-choice questions. These questions cover a wide range of topics related to information privacy management, including:

• Privacy law and regulations
• Data protection principles
• Data governance and risk management
• Incident response and breach management
• Privacy program development and implementation

Candidates are given 120 minutes to complete the exam. To prepare for the CIPM exam, candidates are strongly encouraged to utilize the official IAPP study materials and practice exams such as the CIPM Practice Exam. These resources can help candidates assess their knowledge, identify areas that require further study, and familiarise themselves with the exam format and question types.

Advance Your Career With the Globally Respected CIPM Practice Exam

The Certified Information Privacy Manager (CIPM) certification is a globally recognized credential that demonstrates an individual's expertise in information privacy management. Earning the CIPM certification can significantly advance your career by:

• Validating your knowledge and skills in information privacy management
• Enhancing your credibility and professional reputation
• Demonstrating your commitment to ethical and responsible data-handling practices
• Opening doors to new career opportunities and promotions

The CIPM Practice Exam is an invaluable resource for preparing for the CIPM certification exam. This practice exam provides candidates with a comprehensive overview of the exam content and format, allowing them to identify areas that require further study and improve their chances of success.

By investing in the CIPM Practice Exam and dedicating time and effort to your preparation, you can advance your career and establish yourself as a respected professional in the field of information privacy management.

How Would You Like to Train CIPM Exam Certified Information Privacy Manager (CIPM)?

To effectively train for the Certified Information Privacy Manager (CIPM) exam, it is crucial to adopt a comprehensive and structured approach. The International Association of Privacy Professionals (IAPP) offers a range of training options to help candidates prepare for the CIPM exam, including:

• CIPM Certification Training Course: This instructor-led course provides a comprehensive overview of the exam content and includes practice questions and case studies.
• CIPM Exam Prep Course: This self-paced online course offers a flexible and convenient way to prepare for the exam, with access to video lectures, practice questions, and study materials.
• CIPM Practice Exam: This valuable resource allows candidates to test their knowledge, identify areas that require further study, and familiarise themselves with the exam format and question types.

In addition to these official training options, candidates may also consider:

• Attending industry conferences and webinars
• Reading books and articles on information privacy management
• Joining online forums and discussion groups

By combining these training methods and dedicating sufficient time and effort, candidates can increase their chances of success in obtaining the prestigious CIPM certification.

PDF & Test Engine Bundle

The PDF & Test Engine Bundle is a comprehensive study package designed to help candidates prepare for the Certified Information Privacy Manager (CIPM) exam. This bundle includes:

• CIPM Official Study Guide (PDF): This comprehensive guide covers all the exam topics and includes practice questions and case studies.
• CIPM Practice Exam (Test Engine): This interactive practice exam allows candidates to test their knowledge, identify areas that require further study, and familiarise themselves with the exam format and question types.

The PDF & Test Engine Bundle offers several advantages:

• Convenience: Access the study materials and practice exams anytime, anywhere.
• Flexibility: Study at your own pace and on your schedule.
• Comprehensive: Covers all the exam topics and provides practice questions and case studies.
• Effective: Helps candidates identify areas that require further study and improve their chances of success.

By investing in the PDF & Test Engine Bundle, candidates can enhance their preparation for the CIPM exam and increase their chances of obtaining this prestigious certification.

Test Engine Only

The CIPM Practice Exam (Test Engine Only) is an essential tool for candidates preparing for the Certified Information Privacy Manager (CIPM) exam. This interactive practice exam simulates the actual exam environment and provides candidates with the following benefits:

Performance Tracking: Monitor your progress and track your improvement over time.

Unlimited Attempts: Take the practice exam multiple times to reinforce your learning and build confidence.

Self-Assessment: Test your knowledge and identify areas that require further study.

Exam Familiarization: Become familiar with the exam format, question types, and time constraints.

The CIPM Practice Exam (Test Engine Only) is designed to complement the official study materials and enhance your preparation for the CIPM exam. By leveraging this valuable resource, you can increase your chances of success and obtain this prestigious certification.

PDF Only

The CIPM Official Study Guide (PDF Only) is a comprehensive resource for candidates preparing for the Certified Information Privacy Manager (CIPM) exam. This study guide covers all the exam topics in depth and includes:

• Clear explanations: Understand the key concepts and principles of information privacy management.
• Real-world examples: Apply your knowledge to practical scenarios and case studies.
• Practice questions: Test your understanding and identify areas that require further study.
• Glossary of terms: Clarify unfamiliar concepts and reinforce your learning.

The CIPM Official Study Guide (PDF Only) is an essential tool for your preparation. By studying this guide thoroughly, you can build a strong foundation in information privacy management and increase your chances of success on the CIPM exam.

Training Course Only

The CIPM Certification Training Course (Training Course Only) is a comprehensive and interactive training program designed to prepare candidates for the Certified Information Privacy Manager (CIPM) exam. This instructor-led course covers all the exam topics in depth and includes:

• Expert instruction: Learn from experienced professionals in the field of information privacy management.
• Interactive exercises: Reinforce your learning through hands-on activities and case studies.
• Practice questions: Test your understanding and identify areas that require further study.
• Exam preparation: Get tips and strategies for success on the CIPM exam.

The CIPM Certification Training Course (Training Course Only) is an invaluable resource for your preparation. By attending this course, you can gain a deep understanding of information privacy management and increase your chances of passing the CIPM exam.

Beware of Unauthorized Trainers

When preparing for the Certified Information Privacy Manager (CIPM) exam, it is crucial to be aware of unauthorized trainers and training materials. Unauthorized trainers may not have the necessary expertise or qualifications to adequately prepare candidates for the exam. They may provide inaccurate or outdated information, which can hinder your preparation and potentially lead to failure. To ensure you receive high-quality training and materials, it is essential to choose authorized trainers and resources. The International Association of Privacy Professionals (IAPP) provides a list of authorized trainers on its website.

By choosing authorized trainers, you can be confident that you are receiving the most up-to-date and accurate information, increasing your chances of success on the CIPM exam.

Prepare For CIPM Exam - Free Download - Free CIPM Study Guide

Preparing for the Certified Information Privacy Manager (CIPM) exam can be a daunting task, but with the right resources, you can increase your chances of success. One valuable resource is the free CIPM Study Guide, available for download from the International Association of Privacy Professionals (IAPP). This comprehensive study guide covers all the exam topics in depth and includes:

• Clear explanations: Understand the key concepts and principles of information privacy management.

• Real-world examples: Apply your knowledge to practical scenarios and case studies.

• Practice questions: Test your understanding and identify areas that require further study.

• Glossary of terms: Clarify unfamiliar concepts and reinforce your learning.

By downloading and studying the free CIPM Study Guide, you can gain a strong foundation in information privacy management and increase your chances of passing the CIPM exam.

What is An IAPP Certificate?

An IAPP certificate is a globally recognized credential that demonstrates an individual's expertise in a specific area of information privacy. The International Association of Privacy Professionals (IAPP) offers a range of certification programs, including the Certified Information Privacy Manager (CIPM) certification. To earn an IAPP certificate, candidates must pass a rigorous exam that covers the core concepts and principles of their chosen field. IAPP certifications are highly valued by employers and can significantly enhance an individual's career prospects.

The CIPM certification is particularly relevant for professionals responsible for managing information privacy programs within their organizations. It demonstrates an individual's ability to develop, implement, and maintain effective privacy programs that comply with applicable laws and regulations. By obtaining an IAPP certificate, individuals can validate their knowledge and skills, increase their credibility, and advance their careers in the field of information privacy.

Is IAPP Certification Worth It?

Whether or not an IAPP certification is worth it depends on an individual's career goals and circumstances. However, there are several potential benefits to obtaining an IAPP certification, including Enhanced credibility and recognition: IAPP certifications are globally recognized and respected, demonstrating an individual's expertise and commitment to the field of information privacy.

Increased career opportunities: Many employers seek candidates with IAPP certifications, as they indicate a high level of knowledge and skills in information privacy management. Improved earning potential: Individuals with IAPP certifications often earn higher salaries than those without certifications. Professional development: Preparing for and obtaining an IAPP certification requires a significant investment of time and effort, which can lead to professional growth and development.

The CIPM certification, in particular, is highly valued by employers in the information privacy field. It demonstrates an individual's ability to develop, implement, and maintain effective privacy programs that comply with applicable laws and regulations.

Ultimately, the decision of whether or not to pursue an IAPP certification is a personal one. However, for those seeking to advance their careers in information privacy, an IAPP certification can be a valuable investment.

How Long Does It Take To Get IAPP Certification?

The time it takes to obtain an IAPP certification varies depending on the individual's prior knowledge and experience, as well as the amount of time and effort they can dedicate to studying. The IAPP recommends that candidates for the CIPM certification have at least three to five years of experience in information privacy management. Additionally, candidates should expect to spend approximately 100 hours studying for the exam. Based on these recommendations, it is reasonable to estimate that it could take anywhere from several months to a year or more to prepare for and obtain the CIPM certification. However, it is important to note that the actual time frame may vary depending on an individual's circumstances and commitment to the certification process.

How Much Does the IAPP Cost?

The cost of IAPP certification varies depending on the specific certification program and the membership status of the candidate. For the CIPM certification, the fees are as follows:

• IAPP Members: $575
• Non-Members: $725

In addition to the exam fee, candidates may also incur costs for study materials, training courses, and exam preparation resources. The IAPP offers a variety of membership options, which can provide discounts on exam fees and other benefits. For more information on membership and pricing, please visit the IAPP website.

What Is The Passing Score For the IAPP Exam?

The passing score for the IAPP exam varies depending on the specific certification program. For the CIPM certification, the passing score is 70%. Candidates who do not achieve a passing score on their first attempt may retake the exam after a waiting period of 60 days. There is no limit to the number of times a candidate may retake the exam. To increase their chances of passing the IAPP exam, candidates are encouraged to thoroughly prepare by studying the official study materials, attending training courses, and taking practice exams.

Why This CIPM Certification?

The CIPM certification is a globally recognized credential that demonstrates an individual's expertise in information privacy management. Earning the CIPM certification can provide several benefits, including:

• Enhanced credibility and recognition: The CIPM certification is a respected credential that demonstrates an individual's knowledge and skills in information privacy management.
• Increased career opportunities: Many employers seek candidates with the CIPM certification, as it indicates a high level of expertise in this field.
• Improved earning potential: Individuals with the CIPM certification often earn higher salaries than those without the certification.
• Professional development: Preparing for and obtaining the CIPM certification requires a significant investment of time and effort, which can lead to professional growth and development.

The CIPM certification is particularly relevant for professionals responsible for managing information privacy programs within their organizations. It demonstrates an individual's ability to develop, implement, and maintain effective privacy programs that comply with applicable laws and regulations.

By obtaining the CIPM certification, individuals can validate their knowledge and skills, increase their credibility, and advance their careers in the field of information privacy.

What You’ll Learn With the DumpsArena CIPM Practice Exam

With the DumpsArena CIPM Practice Exam, you'll gain access to a comprehensive set of practice questions that cover all the key topics and objectives of the Certified Information Privacy Manager (CIPM) exam. By working through these practice questions, you'll be able to:

• Assess your knowledge: Identify areas where you are strong and where you need further study.
• Identify your weaknesses: Pinpoint specific areas where you need to focus your preparation efforts.
• Improve your test-taking skills: Become familiar with the exam format and question types, and develop strategies for answering questions effectively.
• Increase your confidence: Gain a sense of confidence and readiness for the actual exam by practicing in a realistic environment.

The DumpsArena CIPM Practice Exam is an essential tool for anyone preparing for the CIPM exam. By utilizing this valuable resource, you can increase your chances of success and earn this prestigious certification.

FAQS

What is the CIPM certification, and why is it important?

The CIPM (Certified Information Privacy Manager) certification is a globally recognized credential designed for professionals who manage data privacy operations within an organization. It demonstrates expertise in implementing privacy programs, managing compliance, and mitigating privacy risks.

What types of questions are included in the CIPM practice exam?

The CIPM practice exam typically includes multiple-choice questions, scenario-based questions, and case studies. These questions focus on privacy program governance, operational lifecycle management, and specific regulations or frameworks relevant to data privacy.

How can I prepare effectively for the CIPM practice exam?

To prepare effectively, review the CIPM Body of Knowledge (BoK), use study materials from reputable sources like the IAPP (International Association of Privacy Professionals), and take multiple practice tests to familiarize yourself with the exam format. Dumpsarena is also considered a reliable source of study materials.

How long should I study before taking the CIPM practice exam?

Preparation time varies depending on your familiarity with privacy management concepts. On average, candidates dedicate 4–6 weeks of focused study, including reading, practice exams, and revising weak areas.

Certified Information Privacy Manager (CIPM)

IAPP CIPM

Version Demo

Total Demo Questions: 10

Total Premium Questions: 166

Buy Premium PDF: https://dumpsarena.com/iapp-dumps/cipm/

QUESTION NO: 1

SCENARIO

Please use the following to answer the next QUESTION:

It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread

over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data-protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.

Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.

You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses, and governmental identification numbers. He sighs and places his head in his hands in despair.

How should this incident most productively be viewed to determine the best course of action?

A. As the accidental loss of personal property containing data that must be restored.

B. As a potential compromise of personal information through unauthorized access.

C. As an incident that requires the abrupt initiation of a notification campaign.

D. As the premeditated theft of company data, until shown otherwise.

QUESTION NO: 2

Which of the following best supports implementing controls to bring privacy policies into effect?

A. The internal audit department establishes the audit controls which test for policy effectiveness.

B. The legal department or outside counsel conducts a thorough review of the privacy program and policies.

C. The Chief Information Officer as part of the Senior Management Team creates enterprise privacy policies to ensure controls are available.

D. The information technology (IT) group supports and enhances the privacy program and privacy policy by developing processes and controls.

QUESTION NO: 3

SCENARIO

Please use the following to answer the next QUESTION:

Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow. With the expansion, Amira and Sadie have received advice from new senior staff members brought on to help manage the company's growth. One recent suggestion has been to combine the legal and security functions of the company to ensure observance of privacy laws and the company's own privacy policy. This sounds overly complicated to Amira, who wants departments to be able to use, collect, store, and dispose of customer data in ways that will best suit their needs. She does not want administrative oversight and complex structuring to get in the way of people doing innovative work. Sadie has a similar outlook. The new Chief Information Officer (CIO) has proposed what Sadie believes is an unnecessarily long timetable for designing a new privacy program. She has assured him that NatGen will use the best possible equipment for electronic storage of customer and employee data. She simply needs a list of equipment and an estimate of its cost.

However, the CIO insists that many issues are necessary to consider before the company gets to that stage. Regardless, Sadie and Amira insist on giving employees space to do their jobs. Both CEOs want to entrust the monitoring of employee policy compliance to low-level managers. Amira and Sadie believe these managers can adjust the company privacy policy according to what works best for their particular departments. NatGen's CEOs know that flexible interpretations of the privacy policy in the name of promoting green energy would be highly unlikely to raise any concerns with their customer base, as long as the data is always used in the course of normal business activities. Perhaps what has been most perplexing to Sadie and Amira has been the CIO's recommendation to institute a privacy compliance hotline. Sadie and Amira have relented on this point, but they hope to compromise by allowing employees to take turns handling reports of privacy policy violations. The implementation will be easy because the employees need no special preparation. They will simply have to document any concerns they hear.

Sadie and Amira are aware that it will be challenging to stay true to their principles and guard against corporate culture strangling creativity and employee morale. They hope that all senior staff will see the benefit of trying a unique approach. What Data Lifecycle Management (DLM) principle should the company follow if they end up allowing departments to interpret the privacy policy differently?

A. Prove the authenticity of the company's records.

B. Arrange for official credentials for staff members.

C. Adequately document reasons for inconsistencies.

D. Create categories to reflect degrees of data importance.

QUESTION NO: 4

An organization's privacy officer was just notified by the benefits manager that she accidentally sent out the retirement enrollment report of all employees to the wrong vendor.

Which of the following actions should the privacy officer take first?

A. Perform a risk of harm analysis.

B. Report the incident to law enforcement.

C. Contact the recipient to delete the email.

D. Send firm-wide email notifications to employees.

QUESTION NO: 5

Data retention and destruction policies should meet all of the following requirements EXCEPT?

A. Data destruction triggers and methods should be documented.

B. Personal information should be retained only for as long as necessary to perform its stated purpose.

C. Documentation related to audit controls (third-party or internal) should be saved in a non-permanent format by default.

D. The organization should be documenting and reviewing policies of its other functions to ensure alignment (e.g. HR, business development, finance, etc.).

QUESTION NO: 6

SCENARIO

Please use the following to answer the next QUESTION:

Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States. Video from the office's video surveillance cameras leaked to news operations showed a drug exchange between Special Handling staff and undercover officers. In the wake of this incident, Kelly had been sent to Providence to change the "hands off" culture that upper management believed had let the criminal elements conduct their illicit transactions. After a few weeks under Kelly's direction, the office became a model of efficiency and customer service. Kelly monitored his workers' activities using the same cameras that had recorded the illegal conduct of their former co-workers. Now Kelly has been charged with turning around the office in Cork, Ireland, another trouble spot. The company has received numerous reports of the staff leaving the office unattended. When Kelly arrived, he found that even when present, the staff often spent their days socializing or conducting personal business on their mobile phones. Again, he observed their behaviors using surveillance cameras. He issued written reprimands to six staff members based on the first day of the video alone.

Much to Kelly's surprise and chagrin, he and the company are now under investigation by the Data Protection Commissioner of Ireland for allegedly violating the privacy rights of employees. Kelly was told that the company's license for the cameras listed facility security as their main use, but he does not know why this matters. He has pointed out to his superiors that the company's training programs on privacy protection and data collection mention nothing about surveillance video. You are a privacy protection consultant, hired by the company to assess this incident, report on the legal and compliance issues, and recommend the next steps.

What should you advise this company regarding the status of security cameras at their offices in the United States?

A. Add security cameras at facilities that are now without them.

B. Set policies about the purpose and use of the security cameras.

C. Reduce the number of security cameras located inside the building.

D. Restrict access to surveillance video taken by the security cameras and destroy the recordings after a designated period of time.

QUESTION NO: 7

If done correctly, how can a Data Protection Impact Assessment (DPIA) create a win/win scenario for organizations and individuals?

A. By quickly identifying potentially problematic data attributes and reducing the risk exposure.

B. By allowing Data Controllers to solicit feedback from individuals about how they feel about the potential data processing.

C. By enabling Data Controllers to be proactive in their analysis of processing activities and ensuring compliance with the law.

D. By better informing about the risks associated with the processing activity and improving the organization's transparency with individuals.

Explanation: A Data Protection Impact Assessment (DPIA) is a process that organizations use to evaluate the potential risks associated with a specific data processing activity, and to identify and implement measures to mitigate those risks. By conducting a DPIA, organizations can proactively identify and address potential privacy concerns before they become a problem, and ensure compliance with data protection laws and regulations.

When organizations are transparent about their data processing activities and the risks associated with them, individuals are better informed about how their data is being used and can make more informed decisions about whether or not to provide their data. This creates a win/win scenario for organizations and individuals, as organizations can continue processing personal data in a compliant and transparent manner, while individuals can trust that their personal data is being used responsibly. Additionally, by engaging with individuals in the DPIA process and soliciting their feedback, organizations can better understand the potential impact of their data processing activities on individuals and take steps to mitigate any negative impacts.

Reference: -https://iapp.org/news/a/privacy-pros-take-note-the-gdpr-is-coming-for-your-dpia/

-https://ec.europa.eu/info/publications/data-protection-impact-assessment-dpia-guidelines_en -https://gdpr-info.eu/art-35gdpr/

QUESTION NO: 8

Which of the following is an example of Privacy by Design (PbD)?

A. A company hires a professional to structure a privacy program that anticipates the increasing demands of new laws.

B. The human resources group develops a training program for employees to become certified in the privacy policy.

C. A labor union insists that the details of employers' data protection methods be documented in a new contract.

D. The information technology group uses privacy considerations to inform the development of new networking software.

QUESTION NO: 9

SCENARIO

Please use the following to answer the next QUESTION: As the company’s new chief executive officer, Thomas Goddard wants to be known as a leader in data protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection circles for its ethically questionable practices, including unauthorized sales of personal data to marketers. Hoopy also was the target of credit card data theft that made headlines around the world, as at least two million credit card numbers were thought to have been pilfered despite the company’s claims that “appropriate” data protection safeguards were in place. The scandal affected the company’s business as competitors were quick to market an increased level of protection while offering similar entertainment and media content. Within three weeks after the scandal broke, Hoopy founder and CEO Maxwell Martin, Goddard’s mentor, was forced to step down.

Goddard, however, seems to have landed on his feet, securing the CEO position at your company, Medialite, which is just emerging from its start-up phase. He sold the company’s board and investors on his vision of Medialite building its brand partly based on industry-leading data protection standards and procedures. He may have been a key part of a lapsed or even rogue organization in matters of privacy but now he claims to be reformed and a true believer in privacy protection.

In his first week on the job, he calls you into his office and explains that your primary work responsibility is to bring his vision for privacy to life. But you also detect some reservations. “We want Medialite to have absolutely the highest standards,” he says. “I want us to be able to say that we are the clear industry leader in privacy and data protection. However, I also need to be a responsible steward of the company’s finances. So, while I want the best solutions across the board, they also need to be cost-effective.”

You are told to report back in a week with your recommendations. Charged with this ambiguous mission, you depart the executive suite, already considering your next steps. You are charged with making sure that privacy safeguards are in place for new products and initiatives. What is the best way to do this?

A. Hold a meeting with stakeholders to create an interdepartmental protocol for new initiatives

B. Institute Privacy by Design principles and practices across the organization

C. Develop a plan for introducing privacy protections into the product development stage

D. Conduct a gap analysis after the deployment of new products, then mend any gaps that are revealed

QUESTION NO: 10

SCENARIO

Please use the following to answer the next QUESTION: It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks.

The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data-protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.

Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset. You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses, and governmental identification numbers. He sighs and places his head in his hands in despair. From a business standpoint, what is the most productive way to view employee use of personal equipment for work-related tasks?

A. The use of personal equipment is a cost-effective measure that leads to no greater security risks than are always present in a modern organization.

B. Any computer or other equipment is company property whenever it is used for company business.

C. While the company may not own the equipment, it is required to protect the business-related data on any equipment used by its employees.

D. The use of personal equipment must be reduced as it leads to inevitable security risks.