1
Q
What are metrics?
A
Quantifiable measures to evaluate organizational success and efficiency.
2
Q
Why are metrics important?
A
- Provide evidence
- Enable decision making
- Show progress
- Support planning
3
Q
What is performance measurement?
A
The process of identifying metrics to evaluate effectiveness.
4
Q
What is a metrics life cycle?
A
The action of sustaining and updating a metric over time.
5
Q
Define KPIs and KRIs.
A
- KPIs: performance indicators
- KRIs: risk indicators used to measure performance and risk
6
Q
What should metrics align with?
A
- Business mission
- Objectives
- Risk appetite
- Audience needs
7
Q
Give examples of PII system inventory metrics.
A
- Number of systems with PII
- PIA completion dates
- Control implementation
- PII categories
8
Q
What are common privacy metrics?
A
- Incident response
- PIA/DPIA-related
- Training
- Data Subject Access Request (DSAR)
- Control assessments
9
Q
How do metrics benefit organizations?
A
- Support decisions
- Communicate concepts
- Normalize vocabulary
- Show maturity
10
Q
What are some features of useful metrics?
A
- Well-defined
- Regularly collected
- Story-telling
- Show compliance and ROI
- Demonstrate impact
11
Q
What are the responsibilities of a metrics owner?
A
- Understand the process
- Communicate purpose
- Update data/processes
- Create visualizations
12
Q
What expertise should a metrics owner have?
A
- Subject matter expertise
- Knowledge of day-to-day operations
13
Q
What does data analysis depend on?
A
- Type of metrics
- Dataset size
- Tools like dashboards (e.g., Power BI, Tableau)
14
Q
What are the main types of analysis in metrics?
A
- Trend analysis
- ROI
- Business resiliency
- Program maturity
15
Q
What is trend analysis?
A
- Identifies patterns over time (upward/downward trends)
- Includes cyclical and irregular components
16
Q
What are examples of cyclical components in trend analysis?
A
Seasonal changes like increased incidents during tax season.
17
Q
What are irregular components in trend analysis?
A
Outliers or data points that don’t fit the pattern.
18
Q
What are statistical trending methods?
A
- Simple data patterns
- Trend fitting (e.g., least squares)
- Noise analysis
- R-squared for fit
19
Q
What is Return on Investment (ROI) in privacy metrics?
A
- Measures financial gain/loss vs. cost
- Links program improvements to reduced business risk
20
Q
What is business resiliency?
A
The ability to adapt to disruptions while maintaining operations and protecting people, assets, and brand.
21
Q
What metrics are associated with business resiliency?
A
- Incident response
- Compliance
- System downtime
22
Q
What is program maturity?
A
A measure of an organization’s capabilities, effectiveness, and ability to improve.
23
Q
What is a maturity model?
A
A tool to assess the maturity of a function.
24
Q
What is the Privacy Maturity Model?
(PMM)
A
A model by AICPA/CICA based on GAPP and CMM to help improve privacy practices.
25
What are the **5 PMM** levels?
1. Ad hoc
2. Repeatable
3. Defined
4. Managed
5. Optimized
26
What are the **characteristics** of each PMM level?
* **Ad hoc**: informal
* **Repeatable**: existing but not documented
* **Defined**: documented and implemented
* **Managed**: control reviews
* **Optimized**: regular review and improvement
27
How do you **establish maturity**?
* Identify privacy officer and stakeholders
* Assign responsibilities
* Assess baseline of program functions
28
What is the **top reporting metric** according to IAPP?
Compliance
29
What categories are included in the IAPP **DPO report metrics**?
* Systems and data
* Legal/regulatory compliance
* Advising
30
What are the **main types of monitoring** in a privacy program?
* Compliance
* Legal/regulatory
* Network environment
* Training/awareness
31
What does **compliance monitoring** involve?
Monitoring PII collection, processing, sharing, and maintenance per laws, sensitivity, and standards.
32
What are the **4 compliance monitoring** approaches?
* Self-monitor
* Audit
* System management
* Risk management
33
What **tools** support legal and regulatory monitoring?
Subscription services that **automate legal/regulatory change tracking**.
34
How is **network environment monitoring** conducted?
* Intrusion Detection Systems (IDS)
* Intrusion Prevention Systems (IPS)
* Continuous system/application monitoring
35
What **metrics** are used for **training and awareness** monitoring?
* Staff training completion rate
* Phishing campaign failure rate
36
What **tools** are used for monitoring?
* Data discovery/scanning
* GRC platforms
* Audits
* Breach logs
* Complaints
* Controls
37
What is an **audit** in the context of a privacy program?
An **assessment** of management, implementation, effectiveness, and compliance of **a privacy program**.
38
**Why** conduct a **privacy audit**?
* Assess compliance
* Identify gaps
* Enable improvement
* Satisfy regulators and industry standards
39
What are the **core phases** of an audit?
* Plan
* Prepare
* Audit
* Report
* Follow-up
40
What activities are included in the '**Plan**' phase of an audit?
* Select auditor/team
* Assess audit risk
* Create timeline
* Hold kickoff meeting
41
What is done during the '**Prepare**' phase?
Confirm audit schedule and finalize audit plan.
42
What happens during the '**Audit**' phase?
Conduct the audit and meet with auditees and stakeholders.
43
What is included in an **audit report**?
* Roles
* Methodology
* Audit scope
* Compliance status
* Supporting evidence
* Remediation steps
44
What are typical **follow-up activities** after an audit?
* Confirm remediation plan, timeline
* Close out audit
45
What are **2 possible additional stages** in an audit?
* Pre-audit data collection
* Pre-report feedback gathering
46
What are the **3 types of audits**?
* First-party
* Second-party
* Third-party
47
What is a **first-party audit**?
An **internal audit** conducted by an organization **on its own processes**, systems, and controls.
48
What are the **goals** of **first-party audits**?
* Drive internal improvements
* Prepare for external audits
* Support self-certification
49
What is a **second-party audit**?
An audit conducted by **an external entity** with **a direct interest**, like a customer or supplier.
50
What are **common reasons** for second-party audits?
* Contract due diligence
* Verification of audit rights
* Assess impacts on business relationships
51
What is a **third-party audit**?
Conducted by an **independent external organization** with **no direct interest** in the auditee.
52
What is the **purpose** of third-party audits?
* Provide objective compliance assessment
* Often needed for certification or regulatory compliance
53
What is the **goal** of **training** in a privacy program?
To **teach knowledge and skills** needed for effective job performance in privacy and security.
54
What is the **purpose** of **awareness**?
* To focus attention on privacy/security
* Build sensitivity to threats
* Reinforce good behavior
55
What are the **4 steps** in **NIST SP 800-50** training lifecycle?
* Design
* Material Development
* Implementation
* Post-Implementation
56
What is **NIST SP 800-16** known for?
It defines role- and performance-based IT security training requirements.
57
What **content** should **privacy training** include?
* Laws
* Regulations
* Policies
* Reporting procedures
* Role-specific guidance
* Attestation
58
What makes training **effective**?
* Mandatory
* Interactive
* Gamified
* Measured
* Integrated with other programs
59
Who is the **target audience** for privacy training?
* **Everyone**: basic awareness
* **Stakeholders**: role-based
* **Privacy team**: specific ongoing training
60
What are **key elements** of building an **internal awareness program**?
* Cross-functional cooperation
* Assessing privacy awareness
* Leveraging incidents
* Attending events
61
Why build an **external awareness** program?
* Build trust
* Earn business
* Demonstrate commitment to protecting consumer privacy
62
What does **operationalizing awareness** involve?
* Creating communication plans
* Involving stakeholders
* Updating policies/requirements
63
Why is **repetition** important in training and awareness?
It **reinforces learning** by strengthening neural connections, enhancing retention.
64
What are examples of **training mediums**?
* Classes (e.g., live virtual, asynchronous e-learning)
* Brown bag lunch events
* Newsletters
* Emails
* Posters
* Handouts
65
What **creative tools** can increase engagement in awareness?
* Stickers
* Memes
* Social media
* Competitions
* Themed awareness days
66
What **outcome metrics** can be collected from training?
* Knowledge check scores
* Incident reduction over time
