| Acknowledgments |
|
xv | |
| Introduction |
|
xvii | |
|
Part I Privacy Governance |
|
|
|
|
|
3 | (56) |
|
Introduction to Privacy Governance |
|
|
3 | (22) |
|
Privacy Governance Influences |
|
|
7 | (10) |
|
Reasons for Privacy Governance |
|
|
17 | (1) |
|
Privacy and Security Governance Activities and Results |
|
|
18 | (1) |
|
|
|
19 | (2) |
|
Monitoring Privacy Responsibilities |
|
|
21 | (1) |
|
Privacy Governance Metrics |
|
|
21 | (4) |
|
Privacy Strategy Development |
|
|
25 | (23) |
|
|
|
25 | (1) |
|
|
|
26 | (6) |
|
|
|
32 | (1) |
|
|
|
32 | (6) |
|
Privacy Program Strategy Development |
|
|
38 | (8) |
|
|
|
46 | (2) |
|
|
|
48 | (11) |
|
|
|
51 | (2) |
|
|
|
53 | (2) |
|
|
|
55 | (4) |
|
|
|
59 | (60) |
|
Privacy Roles and Responsibilities |
|
|
59 | (16) |
|
|
|
62 | (2) |
|
|
|
64 | (1) |
|
Privacy and Security Steering Committees |
|
|
65 | (1) |
|
Business Process and Business System Owners |
|
|
65 | (1) |
|
Custodial Responsibilities |
|
|
66 | (1) |
|
|
|
67 | (1) |
|
Chief Information Security Officer |
|
|
68 | (1) |
|
|
|
69 | (2) |
|
|
|
71 | (1) |
|
|
|
71 | (1) |
|
|
|
72 | (1) |
|
|
|
72 | (1) |
|
|
|
73 | (1) |
|
|
|
73 | (1) |
|
|
|
74 | (1) |
|
|
|
74 | (1) |
|
|
|
74 | (1) |
|
|
|
74 | (1) |
|
|
|
75 | (1) |
|
|
|
75 | (1) |
|
Building a Privacy Operation |
|
|
75 | (10) |
|
Identifying Privacy Requirements |
|
|
76 | (1) |
|
Developing Privacy Policies |
|
|
77 | (3) |
|
Developing and Running Data Protection Operations |
|
|
80 | (1) |
|
Developing and Running Data Monitoring Operations |
|
|
81 | (1) |
|
Working with Data Subjects |
|
|
82 | (2) |
|
|
|
84 | (1) |
|
Privacy Training and Awareness |
|
|
85 | (5) |
|
|
|
85 | (1) |
|
Creating or Selecting Content |
|
|
86 | (1) |
|
|
|
86 | (3) |
|
|
|
89 | (1) |
|
|
|
89 | (1) |
|
|
|
89 | (1) |
|
Third-Party Risk Management |
|
|
90 | (6) |
|
|
|
90 | (2) |
|
Privacy Regulation Requirements |
|
|
92 | (1) |
|
|
|
92 | (4) |
|
Auditing Privacy Operations |
|
|
96 | (10) |
|
|
|
96 | (1) |
|
|
|
97 | (1) |
|
|
|
97 | (1) |
|
|
|
98 | (2) |
|
|
|
100 | (2) |
|
Auditing Specific Privacy Practices |
|
|
102 | (4) |
|
|
|
106 | (1) |
|
Privacy Incident Management |
|
|
106 | (4) |
|
Phases of Incident Response |
|
|
107 | (2) |
|
Privacy Incident Response Plan Development |
|
|
109 | (1) |
|
Privacy Continuous Improvement |
|
|
110 | (1) |
|
|
|
111 | (8) |
|
|
|
113 | (1) |
|
|
|
114 | (2) |
|
|
|
116 | (3) |
|
Chapter 3 Risk Management |
|
|
119 | (56) |
|
The Risk Management Life Cycle |
|
|
120 | (39) |
|
The Risk Management Process |
|
|
120 | (3) |
|
Risk Management Methodologies |
|
|
123 | (9) |
|
|
|
132 | (1) |
|
|
|
133 | (2) |
|
|
|
135 | (1) |
|
|
|
136 | (7) |
|
Vulnerability Identification |
|
|
143 | (2) |
|
|
|
145 | (1) |
|
Risk, Likelihood, and Impact |
|
|
146 | (3) |
|
Risk Analysis Techniques and Considerations |
|
|
149 | (10) |
|
Privacy Impact Assessments |
|
|
159 | (6) |
|
|
|
159 | (1) |
|
Engaging Data Subjects in a PIA |
|
|
160 | (1) |
|
|
|
160 | (1) |
|
Integrating into Existing Processes |
|
|
161 | (1) |
|
Recordkeeping and Reporting |
|
|
161 | (1) |
|
Risks Specific to Privacy |
|
|
162 | (1) |
|
|
|
163 | (1) |
|
|
|
164 | (1) |
|
|
|
165 | (10) |
|
|
|
166 | (1) |
|
|
|
167 | (3) |
|
|
|
170 | (5) |
|
Part II Privacy Architecture |
|
|
|
|
|
175 | (34) |
|
|
|
175 | (10) |
|
|
|
176 | (2) |
|
|
|
178 | (4) |
|
Database Management Systems |
|
|
182 | (3) |
|
|
|
185 | (1) |
|
|
|
185 | (4) |
|
Infrastructure as a Service |
|
|
186 | (1) |
|
|
|
187 | (1) |
|
|
|
187 | (1) |
|
|
|
187 | (1) |
|
Mobile Backend as a Service |
|
|
188 | (1) |
|
|
|
188 | (1) |
|
|
|
189 | (6) |
|
Laptop and Desktop Computers |
|
|
189 | (2) |
|
Virtual Desktop Infrastructure |
|
|
191 | (1) |
|
|
|
191 | (1) |
|
|
|
192 | (1) |
|
|
|
192 | (1) |
|
Connected Devices and Operational Technology |
|
|
193 | (2) |
|
|
|
195 | (2) |
|
|
|
196 | (1) |
|
|
|
196 | (1) |
|
|
|
197 | (1) |
|
|
|
197 | (2) |
|
|
|
197 | (1) |
|
|
|
198 | (1) |
|
Security and Privacy by Design |
|
|
199 | (1) |
|
|
|
199 | (10) |
|
|
|
202 | (1) |
|
|
|
203 | (2) |
|
|
|
205 | (4) |
|
Chapter 5 Applications and Software |
|
|
209 | (54) |
|
Privacy and Security by Design |
|
|
209 | (2) |
|
Systems Development Life Cycle |
|
|
211 | (29) |
|
|
|
211 | (23) |
|
Software Development Risks |
|
|
234 | (1) |
|
Alternative Software Development Approaches and Techniques |
|
|
235 | (2) |
|
|
|
237 | (1) |
|
Acquiring Cloud-based Infrastructure and Applications |
|
|
238 | (2) |
|
Applications and Software Hardening |
|
|
240 | (3) |
|
Application Hardening Principles |
|
|
240 | (2) |
|
|
|
242 | (1) |
|
|
|
243 | (1) |
|
Online Tracking and Behavioral Profiling |
|
|
244 | (11) |
|
Tracking Techniques and Technologies |
|
|
245 | (6) |
|
Tracking in the Workplace |
|
|
251 | (2) |
|
|
|
253 | (2) |
|
|
|
255 | (8) |
|
|
|
258 | (1) |
|
|
|
258 | (3) |
|
|
|
261 | (2) |
|
Chapter 6 Technical Privacy Controls |
|
|
263 | (48) |
|
|
|
263 | (6) |
|
|
|
264 | (1) |
|
Privacy Control Objectives |
|
|
265 | (1) |
|
|
|
265 | (4) |
|
Communication and Transport Protocols |
|
|
269 | (4) |
|
|
|
269 | (1) |
|
|
|
270 | (2) |
|
|
|
272 | (1) |
|
Encryption, Hashing, and De-identification |
|
|
273 | (11) |
|
|
|
273 | (9) |
|
|
|
282 | (2) |
|
|
|
284 | (1) |
|
|
|
285 | (4) |
|
|
|
285 | (4) |
|
Identity and Access Management |
|
|
289 | (12) |
|
|
|
290 | (11) |
|
|
|
301 | (10) |
|
|
|
303 | (1) |
|
|
|
304 | (2) |
|
|
|
306 | (5) |
|
|
|
|
|
|
311 | (24) |
|
|
|
311 | (2) |
|
|
|
312 | (1) |
|
Roles and Responsibilities |
|
|
312 | (1) |
|
Control Objectives and Controls |
|
|
312 | (1) |
|
|
|
313 | (1) |
|
|
|
313 | (1) |
|
|
|
313 | (1) |
|
|
|
314 | (8) |
|
Data Classification Levels |
|
|
315 | (1) |
|
|
|
316 | (2) |
|
Data Loss Prevention Automation |
|
|
318 | (3) |
|
System and Site Classification |
|
|
321 | (1) |
|
Data Quality and Accuracy |
|
|
322 | (1) |
|
Data Flow and Usage Diagrams |
|
|
323 | (1) |
|
|
|
324 | (4) |
|
|
|
325 | (1) |
|
|
|
325 | (1) |
|
|
|
326 | (2) |
|
|
|
328 | (7) |
|
|
|
329 | (1) |
|
|
|
329 | (3) |
|
|
|
332 | (3) |
|
Chapter 8 Data Persistence |
|
|
335 | (22) |
|
|
|
335 | (7) |
|
Collecting Only Required Fields |
|
|
336 | (1) |
|
Collecting Only Required Records |
|
|
337 | (1) |
|
Discarding Data When No Longer Needed |
|
|
337 | (1) |
|
|
|
338 | (1) |
|
|
|
338 | (1) |
|
|
|
339 | (1) |
|
|
|
339 | (2) |
|
Minimization Through De-identification |
|
|
341 | (1) |
|
|
|
342 | (2) |
|
|
|
344 | (1) |
|
|
|
345 | (1) |
|
Data Retention and Archiving |
|
|
345 | (2) |
|
Industry Data Retention Laws |
|
|
345 | (1) |
|
|
|
346 | (1) |
|
|
|
346 | (1) |
|
|
|
347 | (1) |
|
|
|
347 | (10) |
|
|
|
348 | (1) |
|
|
|
349 | (3) |
|
|
|
352 | (5) |
|
Part IV Appendix and Glossary |
|
|
|
Appendix: About the Online Content |
|
|
357 | (4) |
|
|
|
357 | (1) |
|
Your Total Seminars Training Hub Account |
|
|
357 | (1) |
|
|
|
357 | (1) |
|
Single User License Terms and Conditions |
|
|
357 | (2) |
|
|
|
359 | (1) |
|
|
|
359 | (2) |
| Glossary |
|
361 | (36) |
| Index |
|
397 | |
