CIPM STUDY GUIDE QUESTIONS WITH
100% CORRECT ANSWERS
The most common locations of personal or sensitive information within an organization
are: - Answer-IT or information security; HR; Marketing; Customer relationship
management (CRM) systems of customer care and sales departments; Audit and
compliance; Shareholder management
Examples of departments that should be involved in incident response planning include:
- Answer-Business development (BD); Communications and PR; Union leadership;
Finance; President, chief executive officer (CEO); Board of directors
A relatively new type of insurance coverage, called cyber-liability insurance, may cover
many breach-related expenses, including: - Answer-Forensic investigations; Outside
counsel fees; Crisis management services; PR experts; Breach notification; Call center
costs; Credit monitoring; Fraud resolution services
Often, vendors are the ones that suffer a data breach. But because of the way data
breach notification laws are drafted: - Answer-The obligation to notify may fall on your
company, not the vendor.
Guidelines for common incident response planning expectations by function (1 of 2): -
Answer-Information security - Provide guidance regarding how the organization
addresses detection, isolation, removal, and preservation of affected systems
Legal - Ensure the response program is designed to protect privilege and think about
and design the program with an eye toward limiting legal liability
HR - Provide an employee perspective
Marketing - Advise about customer relationship management
BD - Represent knowledge in handling and keeping the account
Guidelines for common incident response planning expectations by function (2 of 2): -
Answer-PR - Plan strategic and tactical communication to inform and influence
Union leadership - Represent union interests
Finance - Calculate and manage the bottom-line impact of containment and correction
President/CEO - Demonstrate value of preventing breaches through actions
Customer care - Offer insight on customer/caller behavior
To help operations run smoothly in a time of crisis, such as during an incident response,
many companies depend on a: - Answer-Business Continuity Plan (BCP). The plan is
typically drafted and maintained by key stakeholders and spells out departmental
,responsibilities and actions teams must take before, during, and after an event. To
ensure proper execution of the BCP, all planning and response teams should know
which stakeholder is responsible for overseeing the plan and who, within a specific job
function, will lead them during an event.
Tabletop exercise: - Answer-A structured readiness-testing activity that simulates an
emergency situation (such as a data breach) in an informal, stress-free setting.
Participants, usually key stakeholders, decision makers, and their alternates gather
around a table to discuss roles, responsibilities, and procedures in the context of an
emergency scenario.
The strategic upside of investing in breach preparedness includes: - Answer-Exposure
of critical gaps in applications, procedures, and plans in a pre-incident phase
Greater overall security for customers, partners, and employees
Reduced financial liability and regulatory exposure
Lower breach-related costs, including legal counsel and consumer notification
Preservation of brand reputation and integrity in the marketplace
Typical costs incurred in responding to a breach include: - Answer-Threat isolation;
forensic investigation; engaging of legal counsel, PR communications, and media
outreach, and; reporting and notification (including printing, postage, and call center)
It can be helpful to think about breach response tasks in broad categories: - Answer-
Secure operations, notify appropriate parties, and fix vulnerabilities. While these
groupings help keep you organized, they are not necessarily meant to be used as a
checklist, as many steps will happen concurrently
The potential for compromising sensitive data exists throughout every business of every
size in every industry. [no definition] - Answer-[no definition]
Every organization must ensure that it has a procedure for retrieving portable storage
devices or media from departing employees. [no definition] - Answer-[no definition]
Immediately following the decision to notify affected parties, tactical portions of the
incident response plan begin to unfold. Companies dealing with an incident may find
themselves balancing two possibly conflicting issues: - Answer-Containment and legal
exposures. An incident response process will need to balance these objectives.
The distinction of individuals in an organization with law degrees who are not serving in
the role of lawyers is important, because: - Answer-In order to protect attorney-client
privilege, the investigation will need to be done at the direction of counsel. Thus, in
many organizations, the leader is, of necessity, legal counsel.
A list of tips to help manage expectations and communicate with executives: (1 of 2) -
Answer-Manage executive leaders' expectations by establishing the frequency of
updates/communications
,Determine what is appropriate for the situation and communicate when/if the frequency
needs to change
Hold a kickoff meeting to present the team with the known facts and circumstances
Provide senior executives with an overview of the event and of the team's expected
course of action
Engage remediation providers to reduce consumers' risk of fraud or identity theft
A list of tips to help manage expectations and communicate with executives: (2 of 2) -
Answer-Convene with individual stakeholders to discuss lawsuits, media inquiries,
regulatory concerns, and other pressing developments
Keep individual response-team members on tract to meet their performance objectives
and timelines
Track budget adherence for all response activities
Contact outside incident response resources to confirm engagement and monitor
performance
Prepare a final analysis of the response effort and lead the post-event evaluation
There is sometimes confusion about who - between legal, CPO/CCO, and CISO -
should be directing and leading an incident response. The best incident response teams
are: - Answer-Those in which the three work together, ensuring maintenance of
privilege, containment, and swift investigations.
There are typically two levels to a response team: - Answer-The leaders who will make
the key decisions about how an incident is handled.
The individuals who will be providing input and support to the core team. Those in this
group will vary depending on the type of incident.
A balance should be struck between ensuring that the appropriate stakeholders are
included but that communications are controlled to avoid legal exposure.
Incident Response Support Roles by Miscellaneous Functions: - Answer-HR: Serve as
information conduit to employees
Finance: Secure resources to fund resolution
Marketing: Establish and maintain a positive and consistent message
PR: Assume positions on the front line
Customer care: Handle breach-related call traffic
BD: Notify key accounts
Union leadership: Communicate and coordinate with union
President/CEO: Promptly allocate funds and personnel and publicly comment on breach
In addition to the support of internal functional leaders, a successful response may
depend heavily on: - Answer-The aid of outside specialists retained to manage
notification (including through print vendors), call center, and breach remediation
activities. It is a best practice to negotiate agreements with experienced breach
response providers prior to having to respond to an incident.
, Another part of containment is fixing the vulnerabilities that allowed the bad actor to
access the systems in the first place. After ensuring any breach is contained, begin
analyzing vulnerabilities and addressing third parties that might have been involved.
Where appropriate, it may be necessary to share learnings, but this should be done in
conjunction with legal steps. Factors to consider include: - Answer-Service Providers:
Were they involved? Is there a need to change access privileges? What steps do they
need to take to prevent future breaches? How can you verify they have taken these
steps?
Network segmentation: Ensure your segmentation plan was effective in containing the
breach.
When investigating an incident, a company will want to make sure that its investigation
and related communications and work product: - Answer-Are protected by attorney-
client privilege, which protects any communication between a lawyer and their client
made for the purpose of giving or obtaining legal advice. The attorney work product
doctrine protects documents or analyses made by a lawyer or at the direction of a
lawyer in anticipation of litigation. A company should involve its attorneys as soon as it
discovers a breach has occurred and ensure that the attorneys are directing the
investigation for the purpose of legal advice or in anticipation of litigation. (CC'ing an
attorney on an email is not enough to create privilege.) It is better to have the process
directed by outside counsel than by inside counsel, because courts have in some
instances ruled that there was no privilege where inside counsel appeared to be acting
in a business rather than a legal capacity.
Not all breaches require notification. There are various types of notification
requirements to regulators and affected individuals. If data was encrypted, or if an
unauthorized individual accidentally accessed but didn't misuse the data, potential harm
and risk can be minimal and companies may not need to notify (based on applicable
laws). Notification may be required even without harm to an individual. Coordinating
with legal counsel to understand notification obligations is critical. [no definition] -
Answer-[no definition]
Escalation and notification: - Answer-Escalation refers to the internal process whereby
employees alert supervisors about a security-related incident, who in turn report the
details to a predefined list of experts - typically the privacy office - which will then
engage IT, information security, facilities, or HR. Notification is the process of informing
affected individuals that their personal data has been breached.
During the management of a privacy incident, it is imperative that all internal
communications are locked down so that inaccurate or incomplete details regarding the
incident are not sent around the organization. The incident response team should be
responsible for all internal communications regarding the incident; these
communications should only be forwarded to staff on a need-to-know basis. [no
definition] - Answer-[no definition]
100% CORRECT ANSWERS
The most common locations of personal or sensitive information within an organization
are: - Answer-IT or information security; HR; Marketing; Customer relationship
management (CRM) systems of customer care and sales departments; Audit and
compliance; Shareholder management
Examples of departments that should be involved in incident response planning include:
- Answer-Business development (BD); Communications and PR; Union leadership;
Finance; President, chief executive officer (CEO); Board of directors
A relatively new type of insurance coverage, called cyber-liability insurance, may cover
many breach-related expenses, including: - Answer-Forensic investigations; Outside
counsel fees; Crisis management services; PR experts; Breach notification; Call center
costs; Credit monitoring; Fraud resolution services
Often, vendors are the ones that suffer a data breach. But because of the way data
breach notification laws are drafted: - Answer-The obligation to notify may fall on your
company, not the vendor.
Guidelines for common incident response planning expectations by function (1 of 2): -
Answer-Information security - Provide guidance regarding how the organization
addresses detection, isolation, removal, and preservation of affected systems
Legal - Ensure the response program is designed to protect privilege and think about
and design the program with an eye toward limiting legal liability
HR - Provide an employee perspective
Marketing - Advise about customer relationship management
BD - Represent knowledge in handling and keeping the account
Guidelines for common incident response planning expectations by function (2 of 2): -
Answer-PR - Plan strategic and tactical communication to inform and influence
Union leadership - Represent union interests
Finance - Calculate and manage the bottom-line impact of containment and correction
President/CEO - Demonstrate value of preventing breaches through actions
Customer care - Offer insight on customer/caller behavior
To help operations run smoothly in a time of crisis, such as during an incident response,
many companies depend on a: - Answer-Business Continuity Plan (BCP). The plan is
typically drafted and maintained by key stakeholders and spells out departmental
,responsibilities and actions teams must take before, during, and after an event. To
ensure proper execution of the BCP, all planning and response teams should know
which stakeholder is responsible for overseeing the plan and who, within a specific job
function, will lead them during an event.
Tabletop exercise: - Answer-A structured readiness-testing activity that simulates an
emergency situation (such as a data breach) in an informal, stress-free setting.
Participants, usually key stakeholders, decision makers, and their alternates gather
around a table to discuss roles, responsibilities, and procedures in the context of an
emergency scenario.
The strategic upside of investing in breach preparedness includes: - Answer-Exposure
of critical gaps in applications, procedures, and plans in a pre-incident phase
Greater overall security for customers, partners, and employees
Reduced financial liability and regulatory exposure
Lower breach-related costs, including legal counsel and consumer notification
Preservation of brand reputation and integrity in the marketplace
Typical costs incurred in responding to a breach include: - Answer-Threat isolation;
forensic investigation; engaging of legal counsel, PR communications, and media
outreach, and; reporting and notification (including printing, postage, and call center)
It can be helpful to think about breach response tasks in broad categories: - Answer-
Secure operations, notify appropriate parties, and fix vulnerabilities. While these
groupings help keep you organized, they are not necessarily meant to be used as a
checklist, as many steps will happen concurrently
The potential for compromising sensitive data exists throughout every business of every
size in every industry. [no definition] - Answer-[no definition]
Every organization must ensure that it has a procedure for retrieving portable storage
devices or media from departing employees. [no definition] - Answer-[no definition]
Immediately following the decision to notify affected parties, tactical portions of the
incident response plan begin to unfold. Companies dealing with an incident may find
themselves balancing two possibly conflicting issues: - Answer-Containment and legal
exposures. An incident response process will need to balance these objectives.
The distinction of individuals in an organization with law degrees who are not serving in
the role of lawyers is important, because: - Answer-In order to protect attorney-client
privilege, the investigation will need to be done at the direction of counsel. Thus, in
many organizations, the leader is, of necessity, legal counsel.
A list of tips to help manage expectations and communicate with executives: (1 of 2) -
Answer-Manage executive leaders' expectations by establishing the frequency of
updates/communications
,Determine what is appropriate for the situation and communicate when/if the frequency
needs to change
Hold a kickoff meeting to present the team with the known facts and circumstances
Provide senior executives with an overview of the event and of the team's expected
course of action
Engage remediation providers to reduce consumers' risk of fraud or identity theft
A list of tips to help manage expectations and communicate with executives: (2 of 2) -
Answer-Convene with individual stakeholders to discuss lawsuits, media inquiries,
regulatory concerns, and other pressing developments
Keep individual response-team members on tract to meet their performance objectives
and timelines
Track budget adherence for all response activities
Contact outside incident response resources to confirm engagement and monitor
performance
Prepare a final analysis of the response effort and lead the post-event evaluation
There is sometimes confusion about who - between legal, CPO/CCO, and CISO -
should be directing and leading an incident response. The best incident response teams
are: - Answer-Those in which the three work together, ensuring maintenance of
privilege, containment, and swift investigations.
There are typically two levels to a response team: - Answer-The leaders who will make
the key decisions about how an incident is handled.
The individuals who will be providing input and support to the core team. Those in this
group will vary depending on the type of incident.
A balance should be struck between ensuring that the appropriate stakeholders are
included but that communications are controlled to avoid legal exposure.
Incident Response Support Roles by Miscellaneous Functions: - Answer-HR: Serve as
information conduit to employees
Finance: Secure resources to fund resolution
Marketing: Establish and maintain a positive and consistent message
PR: Assume positions on the front line
Customer care: Handle breach-related call traffic
BD: Notify key accounts
Union leadership: Communicate and coordinate with union
President/CEO: Promptly allocate funds and personnel and publicly comment on breach
In addition to the support of internal functional leaders, a successful response may
depend heavily on: - Answer-The aid of outside specialists retained to manage
notification (including through print vendors), call center, and breach remediation
activities. It is a best practice to negotiate agreements with experienced breach
response providers prior to having to respond to an incident.
, Another part of containment is fixing the vulnerabilities that allowed the bad actor to
access the systems in the first place. After ensuring any breach is contained, begin
analyzing vulnerabilities and addressing third parties that might have been involved.
Where appropriate, it may be necessary to share learnings, but this should be done in
conjunction with legal steps. Factors to consider include: - Answer-Service Providers:
Were they involved? Is there a need to change access privileges? What steps do they
need to take to prevent future breaches? How can you verify they have taken these
steps?
Network segmentation: Ensure your segmentation plan was effective in containing the
breach.
When investigating an incident, a company will want to make sure that its investigation
and related communications and work product: - Answer-Are protected by attorney-
client privilege, which protects any communication between a lawyer and their client
made for the purpose of giving or obtaining legal advice. The attorney work product
doctrine protects documents or analyses made by a lawyer or at the direction of a
lawyer in anticipation of litigation. A company should involve its attorneys as soon as it
discovers a breach has occurred and ensure that the attorneys are directing the
investigation for the purpose of legal advice or in anticipation of litigation. (CC'ing an
attorney on an email is not enough to create privilege.) It is better to have the process
directed by outside counsel than by inside counsel, because courts have in some
instances ruled that there was no privilege where inside counsel appeared to be acting
in a business rather than a legal capacity.
Not all breaches require notification. There are various types of notification
requirements to regulators and affected individuals. If data was encrypted, or if an
unauthorized individual accidentally accessed but didn't misuse the data, potential harm
and risk can be minimal and companies may not need to notify (based on applicable
laws). Notification may be required even without harm to an individual. Coordinating
with legal counsel to understand notification obligations is critical. [no definition] -
Answer-[no definition]
Escalation and notification: - Answer-Escalation refers to the internal process whereby
employees alert supervisors about a security-related incident, who in turn report the
details to a predefined list of experts - typically the privacy office - which will then
engage IT, information security, facilities, or HR. Notification is the process of informing
affected individuals that their personal data has been breached.
During the management of a privacy incident, it is imperative that all internal
communications are locked down so that inaccurate or incomplete details regarding the
incident are not sent around the organization. The incident response team should be
responsible for all internal communications regarding the incident; these
communications should only be forwarded to staff on a need-to-know basis. [no
definition] - Answer-[no definition]
