Operational Lifecycle - Sustain

Operational Lifecycle - Sustain

1. Monitor

   • To control, manage and report risk associated with privacy management practices.
   • Monitoring should be continuous and based on the organization's risk goals through defined roles and responsibilities
     • Monitoring identifies gaps
       • Auditing ensures consistency/effectivenes and sustainment
         • Communication creates awareness.
   • Typical Outcomes
     • Compliance
     • Awareness
     • Transparency
     • Creditability
     • Validity

2. Monitor Compliance with Established Privacy Policies

   • Organizational privacy office guidance - best starting point
   • Review deff of privacy to organization - as related to your program, org, or industry
   • Laws and reg - mandatory gov policy and guidance based on orgs geo location and industry
   • Technical Controls - means to automate monitoring by providing the assurances to achieve physical, data security and other goals.
   • External Privacy Orgs - industry guidance when none exists or guidance to stregnthen compliance beyond legal or compliance factors
   • Industry frameworks - Taxonomies or privacy categorization guidelines that are non-law or reg based. I.e. ISOs
   • Privacy-enhancing technologies - beyond technical controls - next level technology innovation i.e. P3P and EPAL
   • Cutting edge/Innovative solutions - use of newer or unregulated tech
   • EDU and Awareness - methods to inform employee of important aspects of privacy and basic protections
   • Technical capabilities should be considered a MAJOR FACTOR to monitoring as they reduce the effort and manpower necessary to gather, track many transitions occuring daily

3. Monitor Regulatory and Legislative Changes

   • All orgs should have an est procedure to track and document all reg and leg changes that are relevant to the industry.
     • Subscribe to alerts i.e. Privacy Tracker.
     • External vendors
     • Methods to disseminate identified reg and leg changes throughout the org to primary stakeholders

4. Compliance and Risk Monitoring

   • Reviews collection, use and retention of personal information throughout the orgs info lifecycle
   • Monitoring is essential to:
     • Detect and correct violations
     • Support Enforcement Actions
     • Evaluate progress
   • Approaches
     • Self-monitoring
     • Audit management (internal and external)
     • Security and systems management
     • Risk management

5. Environment Monitoring

   • DLP - Data life cycle protection - comprises of the operational, technical and physical controls to protect the orgs data
   • Governance, risk management and compliance (GRC) umbrella term for the orgs approach to three areas to avoid conflicts, overlaps and gaps
   • Monitoring collaborative technologies i.e. sharepoint, erooms and network folders
   • Monitoring all systems, applications and databases for use patterns
   • DLP - data loss prevention = subset of issues for data life cycle protection
   • Internal monitoring is becoming as important as external monitoring and advanced risk management practices
   • Internal Vulnerabilities
     • Building access
     • Data access and authentication
     • Lack of awareness and training on handling of PI
     • Malicious insider
       • Modifying or stealing confidential or sensitive info
       • Theft of trade secrets or customer info
       • Technically sophisticated crimes that sabotage systems or network

6. Different Approaches

   • Ensure program goals for confidential protection of personal information is achieved
   • Determine if policies, procedures and programs are being followed
   • Minimize consequences of privacy failures through early detection and remediation
   • Provide feedback necessary for privacy program improvement
   • demonstrate to the workforce and the community at large the organizational commitment to privacy manaement
   • Other Areas that Should be Monitored
     • Outsourcing of operations to vendors - who will be handling personal data.
     • Companies that outsource info to a cloud computing provider need procedures for monitoring
     • Security monitoring for mobile devices
     • Forms of Monitoring
       • Active Scanning Tools
       • Audit Activities - include internal and external review of people, processes , financial and tech.
       • Breach Monitoring - driven by laws and reg
         • Best Practices
           • Transparency
           • Education
           • Evaluating old data
           • Minimizing collection
           • Being aware of phishing
           • Social Media Polices
           • Control access to trade secrets
           • Encrypt
       • Complaints Monitoring = repeatable process and tracking to ensure transparency and accountability
       • Data Retention/Management
         • Examples of Improper Data Retention
           • Excessive Colelction
           • Incomplete info
           • Damaged data
           • Outdated info
           • Inadequate access controls
           • Excessive sharing
           • Incorrect processing
           • Inadequate use
           • Undue disclosre
     • More things
       • Dahshborads - (GRC) - Gov, risk compliance tools provide automated means for org to identify document and manage their existing risks and controls
       • Control based monitoring - assessing the design and operational effectiveness of controls
       • HR Practices incl access restrictions
       • Monitoring external - risks that result due to changes in the enviroment/industry
       • Internal - i.e. acquisitings
       • Regulation monitoring

7. Audit

   • A systematic and indpendent examination to determine whether activities involving the processing of DP are carried out in accorance with orgs policies
     • The degree to which, systems, ops and people comply
     • Value
       • Measure privacy effectiveness
       • Demonstrate compliance
       • Increase level of data protection awareness
       • Reveal gaps
       • Basis for privacy remediation and improvement
       • Concerned with improving compliance vs penalties
   • Role of Auditor
     • Checking compliance status
     • Assessing staff awareness
     • Assessing privacy practices
     • Identifying noncompilance and compliance
     • Recommendations for corrective action
     • Reasons to audit
       • Regularly/ad hoc/as required
       • Unclear, dated or changing policies
       • Change management activities i.e. system udpates
       • User error/accidents
       • Hacker/security events
       • Insufficient employee training
       • Change in biz
       • Triggered Events
       • Insider Threat
       • Staffing, cuttbacks and changes to priorities
       • New Third parties
       • Unusual changes i.e. increase in breaches/complaints or incidents
       • New portfolio
   • Steps of an Audit
     • Audit Planning
       • Risk Assesment
       • Scheudle
       • Select Auditor
       • Pre-audit questionnaire
       • Prep meeting/visit
       • Checklist
     • Audit PRep
       • Confirm Schedule
       • Confirm and prepare checklists
       • Sampling criteria
       • Audit Plan
     • Audit
       • Meeting
       • Execution
     • Report
       • Noncompliance records and categories
       • Audit report
       • Closing meeting
       • Distribution
     • Follow-Up
       • Confirm scope
       • Schedule
       • Methodology
       • Closure
   • Align Privacy Ops to an internal and external compliance audit program
     • Compliance Audit
       • Legislation
       • Standards and Guidelines
       • Gaps and Weaknesses
       • Remedial action
       • Improvements
       • +ve & -nv findings
     • Types
       • First Party/Internal Audits
         • Form of self evaluation
           • Risk Management Culture
           • Privacy Risk Factors
           • Level of independence
       • Second Party (EU - include supplier audits)
         • Due to outsourcing these are becoming more important
       • Third Party/External Audits - Independent
         • I.e. public companies
         • IA's support claims of compliance but an EA will prove it with data
         • Advantages
           • Identifying weaknesses of internal controls
           • Lending credibility to internal audit program
           • Level of unbiased expert recommendation
         • Disadvantages
           • Cost/Budget
           • ime or schedule
           • Learning curve
           • Confidentiality
     • Self Certification Frameworks i.e. EU Safe harbor - does not exempt but assures compilenace
   • Audit Compliance With Privacy Policies and Standards
     • How closely an org aligns with legal obligations and stated practices
     • Audit Info Access Modification and Disclosure -
       • Auditors will want to know if DLM and ILM alights with it's privacy policies and reqs.
     • Audit Findings and Communications with Stakeholders
       • A formal record of what was audited/when
       • Areas that do comply and those that don't
       • Details to support findings
       • Suggest corrective action with target dates
       • Post Audit Considerations
         • Audit Findings
         • Risk Level/degree of compliance
         • Accountability for correction (paln)
         • Costs associated with mitigation of findings
         • Approval of remediation process or justification for disapproval
   • Communicate
     • Awareness of policy - internally and externally
       • Vigilant/watchful
       • Everyone who handles PII needs to be alert
       • Training and Awareness - changing bad behaviors and reinforcing good ones
     • Internally
       • Interdep cooperations
     • Externally
       • Don't have same resources/controls as internal
       • More directed/building confidence through brand marketing
   • Ensure Policy Flexibility in Order to Incorporate Leg/Reg/Market Reqs
     • An Orgs PP must use language that allows for change
     • Policy must be flexible
     • Need an effective means of updating workforce
   • Identify, Catalog and Maintain Docs Requiring Updates as Privacy Reqs Change
     • Privacy Policy
       • Internal training tool for staff - must be clearly communicated
     • Privacy Notice
       • External communication to customers. Way to ingrain external accountability. Typically on website
         • FCC can take on an org for deceptive practices
     • Need a way of tracking docs for needed changes.
       • Need a way to communicate changes
     • Reasons for Change
       • Opps for continous improvement
       • Changing reg encironment
       • Responding to changes in biz environment
       • New products/services
     • Targeted Employee, Management and Contractor Training
       • Anyone who handles PI for org
       • Targeted Training - implies variety of training depending on department
       • Should be based on clear policies/standards
       • Operational privacy practices - refers to training related to specific operations, functions and activities that involved handling PI.
       • When policies change - training should be updated