1. Personnel Training for Privacy
Information Privacy & Cybersecurity

2. Definitions of Data Protection
US: Security controls to protect data from being compromised by un-authorized actors (hackers)
Europe: Same as US but add a persons rights to privacy

3. Protected PII is defined as an individual’s name in combination with one or more of the following items:
social security number or foreign national ID number
passport number or visa number
driver’s license number
personal credit card number
bank account number
date and place of birth (both together, not one by itself)
mother’s maiden name
detailed personal financial information (not merely salary history)
detailed medical records
What is Protected PII?

4. What if I need to access PII
Staff have a need to maintain and process some PII (customer & employee records, financial transactions, credit card numbers etc.), but this should be restricted to only those employees that require access.
These employees should be granted special roles and authority to properly access only the appropriate level of PII
What if I need to access PII

5. How Do We Help Protect Privacy
Communication
Education
Training
Testing

6. Communication
Create, publish and review Data Privacy Policies including:
Data Types
Document Classifications
Retention Policy
Responsibilities
Technical and Physical Security

7. Education
Seek out the appropriate education and certifications for you roles
Guide others to the appropriate education and certifications

8. Training Cybersecurity Awareness Campaign
Create Mandatory Training Sessions
Create ongoing newsletters, s, posters, videos
Cybersecurity Awareness Campaign
Training

9. Data Privacy
Social Engineer
Training

10. Testing
Test
Phish
Vish
Shoulder Surf
Tail-Gate

11. Where do I go if I have any questions
SANS.org
ISACA.org
pcisecuritystandards.org