CIPM practice question 26 of 30

SCENARIO Please use the following to answer the next QUESTIO N: Edufox has hosted an annual convention of users of its famous e-learning software…

Choose your answer, then check it against the explanation.

Domain Privacy Program Operational Life Cycle

SCENARIO Please use the following to answer the next QUESTIO N: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family. This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" You want to point out that normal protocols have NOT been followed in this matter. Which process in particular has been neglected?

Answer options

Correct Answer:

Explanation

The scenario describes an employee, Deidre, selecting a third-party app developer based on an informal, personal judgment ("They do good work, so I chose them."). This action completely bypasses the formal, structured process of evaluating a potential vendor's security posture, privacy practices, financial stability, and overall suitability before engaging their services. This formal evaluation is known as vendor due diligence. The failure to conduct this vetting is the specific and primary protocol that has been neglected, creating significant unassessed risk to the personal data of conference attendees. This process is a cornerstone of a mature privacy program's third-party risk management.

Why Incorrect

A. Forensic inquiry: This is a reactive investigation conducted after a data breach or security incident, not a proactive vendor selection process.

B. Data mapping: While necessary for the app, the fundamental failure occurred before this stage, during the improper selection of the vendor who would handle the data.

C. Privacy breach prevention: This is a broad goal or category of controls. Vendor due diligence is a specific, foundational process to achieve that goal, making it the more precise answer.

References

1. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP. In Chapter 6

Section 6.4

"Vendor Management

" the text explicitly states

"The first step in vendor management is selection. This is where the organization performs its due diligence on the vendor." It details that this process involves assessing the vendor's reputation

security practices

and data handling procedures

all of which were neglected in the scenario (p. 189).

2. National Institute of Standards and Technology (NIST). (2015). Supply Chain Risk Management Practices for Federal Information Systems and Organizations (NIST Special Publication 800-161). In Section 2.3.2

"Risk Management Processes

" the framework outlines the necessity of assessing

responding to

and monitoring risk

which includes the initial assessment and selection of third-party suppliers based on their ability to meet security and privacy requirements. The informal selection in the scenario fails this fundamental principle.

3. International Organization for Standardization. (2019). ISO/IEC 27701:2019 Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidance. Clause 7.5.1

"Outsourced processes

" requires the organization to ensure that externally processed PII is adequately protected

which implies a due diligence process to gain that assurance before outsourcing.

Question 26 of 30

Keep practicing

Take the free CIPM practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test