Personnel Training for Privacy Information Privacy & Cybersecurity

Definitions of Data Protection US: Security controls to protect data from being compromised by un-authorized actors (hackers) Europe: Same as US but add a persons rights to privacy

Protected PII is defined as an individual’s name in combination with one or more of the following items: social security number or foreign national ID number passport number or visa number driver’s license number personal credit card number bank account number date and place of birth (both together, not one by itself) mother’s maiden name detailed personal financial information (not merely salary history) detailed medical records What is Protected PII?

What if I need to access PII Staff have a need to maintain and process some PII (customer & employee records, financial transactions, credit card numbers etc.), but this should be restricted to only those employees that require access. These employees should be granted special roles and authority to properly access only the appropriate level of PII What if I need to access PII

How Do We Help Protect Privacy Communication Education Training Testing

Communication Create, publish and review Data Privacy Policies including: Data Types Document Classifications Retention Policy Responsibilities Technical and Physical Security

Education Seek out the appropriate education and certifications for you roles Guide others to the appropriate education and certifications

Training Cybersecurity Awareness Campaign Create Mandatory Training Sessions Create ongoing newsletters, e-mails, posters, videos Cybersecurity Awareness Campaign Training

Data Privacy Social Engineer Training

Testing Test Phish Vish Shoulder Surf Tail-Gate

Where do I go if I have any questions SANS.org ISACA.org pcisecuritystandards.org