ABOUT THE AUTHORS Mike Chapple, PhD, CIPM, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame’s Mendoza College of Business. He is the bestselling author of over 25 books and serves as the Academic Director of the University’s Master of Science in Business Analytics program. Joe Shelley, CIPM, is the Vice President for Libraries and Information Technology at Hamilton College in New York. He oversees information security and privacy programs, IT risk management, business intelligence and analytics, and data governance.

• Introduction xviiAssessment Test xxviiChapter 1 Developing a Privacy Program 1Introduction to Privacy 3What Is Privacy? 4What Is Personal Information? 5What Isn’t Personal Information? 5Why Should We Care about Privacy? 8Generally Accepted Privacy Principles 9Management 10Notice 11Choice and Consent 11Collection 12Use, Retention, and Disposal 12Access 13Disclosure to Third Parties 14Security for Privacy 14Quality 15Monitoring and Enforcement 16Developing a Privacy Program 16Crafting Vision, Strategy, Goals, and Objectives 17Structuring the Privacy Team 20Creating a Program Scope and Charter 22Privacy Roles 25Building Inventories 25Conducting a Privacy Assessment 26Implementing Privacy Controls 27Ongoing Operation and Monitoring 27Data Governance 28Data Governance Approaches 28Data Governance Roles 29Access Requirements 29Governing Information Processing 31Managing the Privacy Budget 31Organizational Budgeting 32Expense Types 32Budget Monitoring 33Communicating about Privacy 34Creating Awareness 34Building a Communications Plan 35Privacy Program Operational Life Cycle 36Summary 36Exam Essentials 37Review Questions 38Chapter 2 Privacy Program Framework 43Develop the Privacy Program Framework 44Examples of Privacy Frameworks 44Develop Privacy Policies, Procedures, Standards, and Guidelines 51Define Privacy Program Activities 52Implement the Privacy Program Framework 57Communicate the Framework 57Aligning with Applicable Laws and Regulations 58Develop Appropriate Metrics 78Identify Intended Audience for Metrics 79Define Privacy Metrics for Oversight and Governance per Audience 80Summary 83Exam Essentials 84Review Questions 86Chapter 3 Privacy Operational Life Cycle: Assess 91Document Your Privacy Program Baseline 93Education and Awareness 94Monitoring and Responding to the Regulatory Environment 94Assess Policy Compliance against Internal and External Requirements 94Data, Systems, and Process Assessment 95Risk Assessment Methods 96Incident Management, Response, and Remediation 97Perform Gap Analysis against an Accepted Standard or Law 97Program Assurance 97Processors and Third-Party Vendor Assessment 98Evaluate Processors and Third-Party Vendors 99Understand Sources of Information 99Risk Assessment 100Contractual Requirements and Ongoing Monitoring 102Physical Assessments 102Mergers, Acquisitions, and Divestitures 103Privacy Assessments and Documentation 105Privacy Threshold Analyses (PTAs) 105Define a Process for Conducting Privacy Assessments 105Summary 108Exam Essentials 108Review Questions 110Chapter 4 Privacy Operational Life Cycle: Protect 115Privacy and Cybersecurity 117Cybersecurity Goals 117Relationship between Privacy and Cybersecurity 118Cybersecurity Controls 119Security Control Categories 120Security Control Types 120Data Protection 121Data Encryption 121Data Loss Prevention 122Data Minimization 123Backups 124Policy Framework 125Cybersecurity Policies 126Cybersecurity Standards 128Cybersecurity Procedures 129Cybersecurity Guidelines 130Exceptions and Compensating Controls 131Developing Policies 133Identity and Access Management 133Least Privilege 134Identification, Authentication, and Authorization 134Authentication Techniques 135Provisioning and Deprovisioning 137Account and Privilege Management 138Privacy by Design 139Privacy and the SDLC 140System Development Phases 141System Development Models 142Integrating Privacy with Business Processes 146Vulnerability Management 146Vulnerability Scanning 147Vulnerability Remediation 147Data Policies 149Data Sharing 149Data Retention 149Data Destruction 150Summary 151Exam Essentials 151Review Questions 153Chapter 5 Privacy Operational Life Cycle: Sustain 157Monitor 158Monitoring the Environment 159Monitor Compliance with Privacy Policies 160Monitor Regulatory Changes 160Compliance Monitoring 161Audit 162Aligning with Audits 163Audit Focus 164Summary 167Exam Essentials 168Review Questions 170Chapter 6 Privacy Operational Life Cycle: Respond 175Data Subject Rights 176Access 177Managing Data Integrity 178Right of Erasure 178Right to Be Informed 180Control over Use 180Complaints 181Handling Information Requests 181Incident Response Planning 182Stakeholder Identification 182Building an Incident Oversight Team 183Building the Incident Response Plan 184Integrating the Plan with Other Functions 187Incident Detection 187Security and Privacy Incidents 187Security Events and Incidents 188Privacy Incidents 188Reporting Privacy Incidents 189Coordination and Information Sharing 190Internal Communications 191External Communications 191Breach Notification 192Incident Handling 192Risk Assessment 193Containment Activities 193Remediation Measures 194Ongoing Communications 195Post-Incident Activity 196Planning for Business Continuity 198Project Scope and Planning 200Business Impact Analysis 204Continuity Planning 211Plan Approval and Implementation 213Summary 218Exam Essentials 219Review Questions 221Appendix Answers to Review Questions 225Chapter 1: Developing a Privacy Program 226Chapter 2: Privacy Program Framework 228Chapter 3: Privacy Operational Life Cycle: Assess 229Chapter 4: Privacy Operational Life Cycle: Protect 231Chapter 5: Privacy Operational Life Cycle: Sustain 233Chapter 6: Privacy Operational Life Cycle: Respond 235Index 239

ABOUT THE AUTHORS Mike Chapple, PhD, CIPM, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame’s Mendoza College of Business. He is the bestselling author of over 25 books and serves as the Academic Director of the University’s Master of Science in Business Analytics program. Joe Shelley, CIPM, is the Vice President for Libraries and Information Technology at Hamilton College in New York. He oversees information security and privacy programs, IT risk management, business intelligence and analytics, and data governance.

• Introduction xviiAssessment Test xxviiChapter 1 Developing a Privacy Program 1Introduction to Privacy 3What Is Privacy? 4What Is Personal Information? 5What Isn’t Personal Information? 5Why Should We Care about Privacy? 8Generally Accepted Privacy Principles 9Management 10Notice 11Choice and Consent 11Collection 12Use, Retention, and Disposal 12Access 13Disclosure to Third Parties 14Security for Privacy 14Quality 15Monitoring and Enforcement 16Developing a Privacy Program 16Crafting Vision, Strategy, Goals, and Objectives 17Structuring the Privacy Team 20Creating a Program Scope and Charter 22Privacy Roles 25Building Inventories 25Conducting a Privacy Assessment 26Implementing Privacy Controls 27Ongoing Operation and Monitoring 27Data Governance 28Data Governance Approaches 28Data Governance Roles 29Access Requirements 29Governing Information Processing 31Managing the Privacy Budget 31Organizational Budgeting 32Expense Types 32Budget Monitoring 33Communicating about Privacy 34Creating Awareness 34Building a Communications Plan 35Privacy Program Operational Life Cycle 36Summary 36Exam Essentials 37Review Questions 38Chapter 2 Privacy Program Framework 43Develop the Privacy Program Framework 44Examples of Privacy Frameworks 44Develop Privacy Policies, Procedures, Standards, and Guidelines 51Define Privacy Program Activities 52Implement the Privacy Program Framework 57Communicate the Framework 57Aligning with Applicable Laws and Regulations 58Develop Appropriate Metrics 78Identify Intended Audience for Metrics 79Define Privacy Metrics for Oversight and Governance per Audience 80Summary 83Exam Essentials 84Review Questions 86Chapter 3 Privacy Operational Life Cycle: Assess 91Document Your Privacy Program Baseline 93Education and Awareness 94Monitoring and Responding to the Regulatory Environment 94Assess Policy Compliance against Internal and External Requirements 94Data, Systems, and Process Assessment 95Risk Assessment Methods 96Incident Management, Response, and Remediation 97Perform Gap Analysis against an Accepted Standard or Law 97Program Assurance 97Processors and Third-Party Vendor Assessment 98Evaluate Processors and Third-Party Vendors 99Understand Sources of Information 99Risk Assessment 100Contractual Requirements and Ongoing Monitoring 102Physical Assessments 102Mergers, Acquisitions, and Divestitures 103Privacy Assessments and Documentation 105Privacy Threshold Analyses (PTAs) 105Define a Process for Conducting Privacy Assessments 105Summary 108Exam Essentials 108Review Questions 110Chapter 4 Privacy Operational Life Cycle: Protect 115Privacy and Cybersecurity 117Cybersecurity Goals 117Relationship between Privacy and Cybersecurity 118Cybersecurity Controls 119Security Control Categories 120Security Control Types 120Data Protection 121Data Encryption 121Data Loss Prevention 122Data Minimization 123Backups 124Policy Framework 125Cybersecurity Policies 126Cybersecurity Standards 128Cybersecurity Procedures 129Cybersecurity Guidelines 130Exceptions and Compensating Controls 131Developing Policies 133Identity and Access Management 133Least Privilege 134Identification, Authentication, and Authorization 134Authentication Techniques 135Provisioning and Deprovisioning 137Account and Privilege Management 138Privacy by Design 139Privacy and the SDLC 140System Development Phases 141System Development Models 142Integrating Privacy with Business Processes 146Vulnerability Management 146Vulnerability Scanning 147Vulnerability Remediation 147Data Policies 149Data Sharing 149Data Retention 149Data Destruction 150Summary 151Exam Essentials 151Review Questions 153Chapter 5 Privacy Operational Life Cycle: Sustain 157Monitor 158Monitoring the Environment 159Monitor Compliance with Privacy Policies 160Monitor Regulatory Changes 160Compliance Monitoring 161Audit 162Aligning with Audits 163Audit Focus 164Summary 167Exam Essentials 168Review Questions 170Chapter 6 Privacy Operational Life Cycle: Respond 175Data Subject Rights 176Access 177Managing Data Integrity 178Right of Erasure 178Right to Be Informed 180Control over Use 180Complaints 181Handling Information Requests 181Incident Response Planning 182Stakeholder Identification 182Building an Incident Oversight Team 183Building the Incident Response Plan 184Integrating the Plan with Other Functions 187Incident Detection 187Security and Privacy Incidents 187Security Events and Incidents 188Privacy Incidents 188Reporting Privacy Incidents 189Coordination and Information Sharing 190Internal Communications 191External Communications 191Breach Notification 192Incident Handling 192Risk Assessment 193Containment Activities 193Remediation Measures 194Ongoing Communications 195Post-Incident Activity 196Planning for Business Continuity 198Project Scope and Planning 200Business Impact Analysis 204Continuity Planning 211Plan Approval and Implementation 213Summary 218Exam Essentials 219Review Questions 221Appendix Answers to Review Questions 225Chapter 1: Developing a Privacy Program 226Chapter 2: Privacy Program Framework 228Chapter 3: Privacy Operational Life Cycle: Assess 229Chapter 4: Privacy Operational Life Cycle: Protect 231Chapter 5: Privacy Operational Life Cycle: Sustain 233Chapter 6: Privacy Operational Life Cycle: Respond 235Index 239