IT Privacy Certification

(1)

Pease International Tradeport ∙ 75 Rochester Avenue. Suite 4 ∙ Portsmouth, NH 03801 USA +1 603.427.9200 ∙ [email protected]

1

IT Privacy Certification

Program Introduction

Overview

The Certified Information Privacy Professional/Information Technology (CIPP/IT) is the newest credentialing initiative from the IAPP and the first global privacy certification for IT practitioners. The CIPP/IT cert ifies individuals in their knowledge of privacy-related issues and practices in the context of the design and implementation of information and communications technologies.

The IAPP developed the CIPP/IT program in consultation with leading IT privacy academics as well as privacy officers and executives from a variety of global corporations and professional associations. These include Carnegie Mellon University, Indiana University, IBM Corporation, Oracle Corporation (formerly Sun Microsystems), Microsoft Corporation, Hewlett-Packard Company, LexisNexis Group, Intel

Corporation, FirstData Corporation, Ernst & Young, The Procter & Gamble Company, Citizens Financial Group, the Data Security Council of India and the National Association of State CIOs (NASCIO).

Who Should Apply

The CIPP/IT certification establishes educational and testing standards in information privacy policies and practices for professionals who are responsible for the design, acquisition, implementation, configuration, audit, or management of IT products or services across any organization and from any location in the world. These individuals include:

• Enterprise system architects (CTO, CIO)

• Business process professionals (purchase decision -makers for IT services and products) • Business intelligence professionals (providers of data for organizational decision support) • Designers, developers, engineers, auditors and administrators of software, network or

database systems or applications • Hardware designers and engineers • IT managers

• Web site operators

• Desktop support specialists

• Risk and regulatory compliance managers • Information security professionals (CISO, CSO)

(2)

2 Certification Requirements

CIPP/IT certification requires the successful completion of both the IAPP Certification Foundation Examination and the CIPP/IT Examination (offered separately) for a grand total of three hours of testing:

• First-time candidates for IAPP privacy certification (e.g. individuals who do not presently hold any IAPP certification) must activate an IAPP membership at any level in advance of their test and then pass both the Certification Foundation Examination, a two-hour, three-part, 120-item, objective test and the CIPP/IT Examination, a one-hour, one-part, 60-120-item, objective test. • Existing IAPP-certified professionals (e.g. individuals who presently hold a CIPP, CIPP/G or

CIPP/C designation) are “grandfathered” into the IAPP membership and Foundation testing requirements –but must still meet the CIPP/IT requirement by passing the CIPP/IT Examination, a one-hour, one-part, 60-item, objective test.

“Successful completion” of CIPP/IT is defined as an aggregate score of 70% or greater on each exam (as applicable under each scenario above). This means at least 84 out of 120 total points for Certification Foundation exam and at least 42 out of 60 total points for CIPP/IT exam. Partial completion of either exam will result in no credential being awarded until such time that all requirements are met. The exams may be taken in sequence at the same sitting or separately at different testing events.

Upon successful completion of the exam(s), the CIPP/IT certification becomes active on the date of examination and remains in force annually provided that: IAPP membership remains in good standing each year; and, a minimum of ten (10) credit hours of continuing privacy education (“CPE”) is met each year. CPE is defined as any program, event, forum, book, presentation, speaking engagement or teaching engagement that relates in whole to information privacy, security, auditing, risk management or legal compliance whether provided by the IAPP or by another professional organization such as (ISC)2, ISSA or ISACA. Specific guidelines on CPE-eligible programs and application processes are available for review at www.privacyassociation.org.

Course Format

The common body of knowledge (“CBK”) for the CIPP/IT certification is described on the following pages in outline form. The course consists of six subject matter areas:

I. System Activities that Impact End User Privacy II. Data Subject Privacy Expectations and Behaviors III. Privacy Protection Mechanisms

IV. Providing Notice and Choice

V. Auditing and Enforcing IT Privacy Compliance VI. Implementing Technologies with Privacy Impacts

Course References

Training for CIPP/IT certification is optional and available through the Certification Foundation Training Workshop and the CIPP/IT Training Workshop. Each of these courses is presented as live classroom instruction sessions at major IAPP conferences and events. For additional program references, please consult the CIPP/IT supplemental reading list.

(3)

3

IT Privacy Certification

Outline of the Common Body of Knowledge (“CBK”) for

The Certified Information Privacy Professional/Information

Technology (“CIPP/IT”)

I. System Activities that Impact End User Privacy

A. The Information Lifecycle a. Manual processes

i._Interaction ii. Data entry b. Systems

i._{Operating and file} ii. Database

iii._Applications

iv. Network and data transport v. Web services

vi._{Client services} c. Data types

i._{Personally identifiable information (PII)} ii. Regulated information (SOX, HIPAA) iii._{Credit card information}

iv._{Trade secrets (organization)}

v. Contractual information (partners, customers) B. The IT Development Lifecycle

a. Privacy intersections in the development process i. Release planning

ii._Definition iii. Development iv._Validation

(4)

4

C._{Data collection and transfer}

a._{Responsibilities of the IT professional} b._{Determining data accountability}

i. Ownership of data ii._{Data inventory}

iii. Degree of data sensitivity c._{Purpose and uses of PII}

i. PCI regulated data d. Employee data uses e._{Onward transfers of data}

i. External parties

ii._{Storage/transfer media}

iii._{Routine and non-routine transfers} f._{Employee data challenges}

i._{Locations and modes}

ii. Business use of mobile services D. Data Security

a._{Top 20 security risks (SANS)} i. Client-side

ii._Server-side

iii. Security policy and personnel iv. Application

1. SQL injection v. Network

b._{Credit card information} i. Cardholder data types

ii._{Application of Payment Card Industry Data Security Standards (PCI DSS)} E. Data Storage a. Types of storage i._Persistent ii. Transient b. Location of storage i._Systems ii. Location F._{Data Processing} a._{Internal processing}

i. Primary and secondary uses b._{Relationships with third parties}

i. Global resourcing and outsourcing ii. Vendor management

G. Data Retention and Destruction a. Period of retention

b. Duplication of records

(5)

5

H. Data Access and redress a. Legal requirements b._{Business rationale} c._{Access mechanisms} d. Handling requests I. Privacy and System Design

a. Applying Fair Information Practice principles i. Collection limitation

ii._{Data quality}

iii. Purpose specification iv._{Use limitation}

v._{Security safeguards} vi._Openness

vii._{Individual participation} viii. Accountability

II. Data Subject Privacy Expectations and Behaviors

A._{Privacy Expectations}

a. The consumer perspective b._{Organizational practices} B._{Privacy Responsibility Framework}

a. User sphere b._{Joint sphere} c. Recipient sphere

d._{Engineering issues and responsibilities} C. E-commerce Personalization

a. End user benefits

b._{End user privacy concerns} i. Unsolicited marketing ii._{Inaccurate inferences} iii._{Price discrimination}

iv. Unauthorized account access or data sharing D. System Monitoring

(6)

6

III. Privacy Protection Mechanisms

A._{Privacy by Architecture}

a._{Addressing data protection gaps} b. Separating profile and transaction data c. Granularity levels for data collection d._{Limiting common attributes and identifiers} e. Regular or forced deletion of profile data f._{Decentralized privacy architecture} B._{Privacy by policy}

a. Notice and choice b._{Security safeguards} c. Access

d. Accountability i. Audits C._{Identifiability}

a._{Labels that point to individuals} b._{Strong and weak identifiers}

c. Pseudonymous and anonymous data d._{Degrees of identifiability}

i. Definition under the EU Directive

ii._{Privacy stages and system characteristics} 1. Identifiable versus identified 2. Linkable versus linked D. Privacy-enhancing Techniques

a. Web security protocols

i. Transport Security Layer (TLS) ii._{Secure Sockets Layer (SSL)}

iii. Hypertext Transfer Protocol-Secure (HTTPS) b._{Automated data retrieval}

c. Automated system audits

d._{Data masking and data obfuscation} e._{Data encryption}

i. Cryptography

1._{Crypto design and implementation considerations} 2. Application or field encryption

3. File encryption 4. Disk encryption

(7)

7

E._{Privacy-enhancing Tools}

a._{Limiting or preventing automated data capture} b._{Combating threats and exploits}

c. Anonymity tools i._Anonymizers

ii. Privacy-preserving data mining iii._{Applications of anonymity tools}

1. Communication and publishing 2. Payment processing

3._{Voting and surveying} 4. Credentialing

5._{Anonymity by Web proxy}

a._{The Tor Anonymity System}

IV. Providing Notice and Choice

A._{Types of notice and choice} a._{Policy components} b._{Means of distribution} c. Explicit and implicit consent B. Software-based notice and consent

a. Guidelines

b. End user license agreement (EULA) c._Mechanisms

i. Out-of-box ii. Installation time iii. First-run

iv. Just-in-time

v. Collections and/or transfers of data vi. Online services

1._{Redirecting Internet searches and queries} 2. Modifying Web browser settings

3._{Activating a feature function with system impact} 4._{Online advertising}

5. Software updates 6._{Software removal} 7. Location-based services

vii. Machine-readable privacy policy languages

1. Platform for Privacy Preferences Project (P3P) a. User agents

b._{Policy assertions} c. Deployment

2._{Application Preference Exchange Language (APPEL)} 3._{Enterprise Privacy Authorization Language (EPAL)}

(8)

8

V. Auditing and Enforcing IT Privacy Compliance

A._{Data Governance}

a. Management, control and evaluation frameworks i. ISO/IEC 38500:2008

ii. Control Objectives for Information and Related Technology (COBIT) b. IT service management frameworks

i. Information Technology Infrastructure Library (ITIL) ii. IBM Tivoli Unified Process (ITUP)

c._{Industry consortia security frameworks}

i. Payment Card Industry Data Security Standards (PCI DSS) ii. Health Information Trust Alliance (HITRUST)

d._{Security risk and compliance review (SRCR)} B._{Audits in the Context of Privacy}

a._{Defining the “audit”}

b. Understanding the range of options i. Gap assessments (risk) ii. Legal reviews (compliance) iii. Attestation (third party)

c._{Generally Accepted Privacy Principles (“GAPP”) framework} d. Role of the IT auditor

i. Privacy impact assessments (PIA) ii. Control objectives

iii. Evidence and documentation iv. Testing and verification e. IT internal audit

i. Working with legal and compliance partners

VI. Implementing Technologies with Privacy Impacts

A. Software as a Service (SaaS) a._{Cloud Computing Platforms}

i. Location considerations

ii. Impacts on privacy obligations and protections iii. Legal uncertainty

B._{Wireless IDs}

a._{Radio Frequency Identification (RFID)} b. Bluetooth devices

C._{Location-based services}

a._{Global Positioning Systems (GPS)} b. Geographic Information Systems (GIS)

(9)

9

D. Identity and Access Management (IAM) a. Role-based access control (RBAC) b._{User-based access controls} c._{Context of authority}

i. User to site ii. User to enterprise

1. Multiple enterprises

d._{Cross-enterprise authentication and authorization models} i. Liberty Alliance Project

ii. Open ID Federation

iii. Identity Metasystem Architecture E._{Business Intelligence and Analytics}

a._Applications

b._{Demand among businesses and governments} c. Risks