cipm question 120 discussion

Question 120

SCENARIO
Please use the following to answer the next QUESTION:
As they companys new chief executive officer, Thomas Goddard wants to be known as a leader in
data protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in
online video viewing with millions of users around the world. Unfortunately, Hoopy is infamous

within privacy protection circles for its ethically Questionable practices, including unauthorized sales
of personal data to marketers. Hoopy also was the target of credit card data theft that made
headlines around the world, as at least two million credit card numbers were thought to have been
pilfered despite the companys claims that appropriate data protection safeguards were in place.
The scandal affected the companys business as competitors were quick to market an increased level
of protection while offering similar entertainment and media content. Within three weeks after the
scandal broke, Hoopy founder and CEO Maxwell Martin, Goddards mentor, was forced to step down.
Goddard, however, seems to have landed on his feet, securing the CEO position at your company,
Medialite, which is just emerging from its start-up phase. He sold the companys board and investors
on his vision of Medialite building its brand partly on the basis of industry-leading data protection
standards and procedures.
He may have been a key part of a lapsed or even rogue organization in matters of privacy but now he
claims to be reformed and a true believer in privacy protection. In his first week on the job, he calls
you into his office and explains that your primary work responsibility is to bring his vision for privacy
to life. But you also detect some reservations. We want Medialite to have absolutely the highest
standards, he says. In fact, I want us to be able to say that we are the clear industry leader in
privacy and data protection. However, I also need to be a responsible steward of the companys
finances. So, while I want the best solutions across the board, they also need to be cost effective.
You are told to report back in a weeks time with your recommendations. Charged with this
ambiguous mission, you depart the executive suite, already considering your next steps.
You give a presentation to your CEO about privacy program maturity. What does it mean to have a
managed privacy program, according to the AICPA/CICA Privacy Maturity Model?

• A. Procedures or processes exist, however they are not fully documented and do not cover all relevant aspects.
• B. Procedures and processes are fully documented and implemented, and cover all relevant aspects.
• C. Reviews are conducted to assess the effectiveness of the controls in place.
• D. Regular review and feedback are used to ensure continuous improvement toward optimization of the given process.