PII REVIEW PRACTICE STUDY GUIDE
TEST.
Your organization has a new requirement for annual security training. To track trainin completion, they
are using employee social security numbers as record identification. Are they compliant or non-
compliant? - CORRECT ANSWER Non-compliant
Your coworker was teleworking when the agency email system shut down. She had an urgent deadline
so sent you an encrypted set of records containing PII from her personal email account. Compliant or
non? - CORRECT ANSWER Non-compliant
You are reviewing personnel records containing PII when you notice a record with missing information.
You contact the individual to update the personnel record. Compliant or non? - CORRECT ANSWER
Compliant
Must report breach 1 hour to US-CERT, 24 hours to Component Privacy Office, 48 hours to the Defense
Privacy, Civil Liberties & transparency division - CORRECT ANSWER DoD 5400.11-R
Organizations can incur what type of PII penalties? - CORRECT ANSWER Civil
What type of penalties can individuals incur for PII breach? - CORRECT ANSWER Criminal
T/F phishing is responsible for most of the recent PII breaches? - CORRECT ANSWER True
T/F Following a breach, organizations must issue a breach notification. - CORRECT ANSWER True
If you discover PII on the web, immediately close your browser & delete all information regarding the
URL - CORRECT ANSWER False
Organizations can incur civil penalties for failing to uphold their PII responsibilities. - CORRECT ANSWER
True
TEST.
Your organization has a new requirement for annual security training. To track trainin completion, they
are using employee social security numbers as record identification. Are they compliant or non-
compliant? - CORRECT ANSWER Non-compliant
Your coworker was teleworking when the agency email system shut down. She had an urgent deadline
so sent you an encrypted set of records containing PII from her personal email account. Compliant or
non? - CORRECT ANSWER Non-compliant
You are reviewing personnel records containing PII when you notice a record with missing information.
You contact the individual to update the personnel record. Compliant or non? - CORRECT ANSWER
Compliant
Must report breach 1 hour to US-CERT, 24 hours to Component Privacy Office, 48 hours to the Defense
Privacy, Civil Liberties & transparency division - CORRECT ANSWER DoD 5400.11-R
Organizations can incur what type of PII penalties? - CORRECT ANSWER Civil
What type of penalties can individuals incur for PII breach? - CORRECT ANSWER Criminal
T/F phishing is responsible for most of the recent PII breaches? - CORRECT ANSWER True
T/F Following a breach, organizations must issue a breach notification. - CORRECT ANSWER True
If you discover PII on the web, immediately close your browser & delete all information regarding the
URL - CORRECT ANSWER False
Organizations can incur civil penalties for failing to uphold their PII responsibilities. - CORRECT ANSWER
True
