Exam CIPM All QuestionsBrowse all questions from this exam
Go to Exam
Question 104

SCENARIO -

Please use the following to answer the next question:

As they company’s new chief executive officer, Thomas Goddard wants to be known as a leader in data protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection circles for its ethically questionable practices, including unauthorized sales of personal data to marketers. Hoopy also was the target of credit card data theft that made headlines around the world, as at least two million credit card numbers were thought to have been pilfered despite the company’s claims that “appropriate” data protection safeguards were in place. The scandal affected the company’s business as competitors were quick to market an increased level of protection while offering similar entertainment and media content. Within three weeks after the scandal broke, Hoopy founder and CEO Maxwell Martin, Goddard’s mentor, was forced to step down.

Goddard, however, seems to have landed on his feet, securing the CEO position at your company, Medialite, which is just emerging from its start-up phase. He sold the company’s board and investors on his vision of Medialite building its brand partly on the basis of industry-leading data protection standards and procedures. He may have been a key part of a lapsed or even rogue organization in matters of privacy but now he claims to be reformed and a true believer in privacy protection. In his first week on the job, he calls you into his office and explains that your primary work responsibility is to bring his vision for privacy to life. But you also detect some reservations. “We want Medialite to have absolutely the highest standards,” he says. “In fact, I want us to be able to say that we are the clear industry leader in privacy and data protection. However, I also need to be a responsible steward of the company’s finances. So, while I want the best solutions across the board, they also need to be cost effective.”

You are told to report back in a week’s time with your recommendations. Charged with this ambiguous mission, you depart the executive suite, already considering your next steps.

You give a presentation to your CEO about privacy program maturity. What does it mean to have a “managed” privacy program, according to the AICPA/CICA Privacy Maturity Model?

    Correct Answer: C

    A 'managed' privacy program, according to the AICPA/CICA Privacy Maturity Model, is characterized by the fact that reviews are conducted to assess the effectiveness of the controls in place. This stage comes after defining and implementing the procedures and processes, and it involves regularly evaluating these controls to ensure they meet the organization's privacy objectives.

Discussion
emily0922Option: C

C is correct, this is an accurate description of 'Managed'. For reference, the other options are: A- Repeatable B-Defined D- Optimised

SsouravOption: B

B. Procedures and processes are fully documented and implemented, and cover all relevant aspects. This is what it means to have a "managed" privacy program. The maturity levels typically progress from initial (ad hoc) to repeatable, defined, managed, and finally optimized. In the "managed" stage, processes are standardized, documented, and followed organization-wide.

MaritzTeeOption: C

B is for "defined." Managed is where you then have reviews conducted to evaluate the effectiveness of these controls to ensure they are meeting the organization's privacy objectives. This level of maturity involves ongoing monitoring and assessment to maintain and improve the privacy program over time.

MaritzTeeOption: B

B. Procedures and processes are fully documented and implemented, and cover all relevant aspects. According to the AICPA/CICA Privacy Maturity Model, a “managed” privacy program means that procedures and processes are fully documented and implemented, and cover all relevant aspects. This indicates that the organization has established a comprehensive and systematic approach to privacy management, ensuring that all necessary elements are addressed and maintained effectively.

thecheaterzOption: C

From CIPM book - “Managed,” or maturity level four, indicates that reviews are conducted to assess the effectiveness of the controls in place.

DPRamoneOption: C

C. Ref. https://www.privacyauditorblog.com/2022/05/privacy-program-assessment-aicpa.html

carlosbuiOption: B

should be B