Program Monitoring and Metrics CDPSE Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A technology company has a privacy program with several key controls, including data retention policies and access reviews. The privacy manager wants to establish a process to ensure these controls are operating effectively on an ongoing basis. Which approach is most appropriate?

   • AImplement a continuous monitoring process that regularly tests and reviews the operation of key controls, with more frequent checks for higher-risk areas.
   • BRely on employee self-attestations that they are following the policies.
   • CMonitor controls only when a privacy incident occurs.
   • DConduct a comprehensive audit of all privacy controls once every three years.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large organization has a mature privacy program. The privacy team is designing a monitoring process for its key controls, which include data retention, access management, and vendor management. The team has limited resources and must prioritize its monitoring efforts. Which approach is most appropriate for the team to take?

   • AFocus monitoring efforts on the controls that are easiest to test, to maximize the number of controls reviewed.
   • BPrioritize monitoring of controls that protect the most sensitive data and have the highest potential impact if they fail.
   • CMonitor all controls with the same frequency to ensure equal coverage across the program.
   • DDefer monitoring of all controls until the next annual audit is scheduled.
   Reveal Solution Discussion Select an answer first