Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- PRI-21_A01 privacy notice(s) are developed and posted on all external-facing websites.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)[01] - PRI-21_A02 privacy notice(s) are developed and posted on all mobile applications.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)[02] - PRI-21_A03 privacy notice(s) are developed and posted on all other digital services.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)[03] - PRI-21_A04 the privacy notice(s) are written in plain language.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)(a)[01] - PRI-21_A05 the privacy notice(s) are organized in a way that is easy to understand and navigate.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)(a)[02] - PRI-21_A06 the privacy notice(s) provide the information needed by the public to make an informed decision about whether to interact with the organization.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)(b)[01] - PRI-21_A07 the privacy notice(s) provide the information needed by the public to make an informed decision about how to interact with the organization.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)(b)[02] - PRI-21_A08 the privacy notice(s) are updated whenever the organization makes a substantive change to the practices it describes.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)(c)[01] - PRI-21_A09 the privacy notice(s) include a time/date stamp to inform the public of the date of the most recent changes.
Assessment rigor: 1
Origin: 53A_R5_PM-20(01)(c)[02] - PRI-21_A10 the frequency at which a notice is provided to individuals after initial interaction with an organization is defined.
Defined parameters: at least annually, and upon material change to Personal Data (PD) processing practices
Assessment rigor: 3
Origin: 53A_R5_PT-05_ODP[01] - PRI-21_A11 information to be included with the notice about the processing of Personal Data (PD) is defined.
Assessment rigor: 3
Origin: 53A_R5_PT-05_ODP[02] - PRI-21_A12 a notice to individuals about the processing of Personal Data (PD) is provided such that the notice is available to individuals upon first interacting with an organization.
Assessment rigor: 3
Origin: 53A_R5_PT-05a.[01] - PRI-21_A13 a notice to individuals about the processing of Personal Data (PD) is provided such that the notice is subsequently available to individuals frequency.
Defined parameters: at least annually, and upon material change to Personal Data (PD) processing practices
Assessment rigor: 3
Origin: 53A_R5_PT-05a.[02] - PRI-21_A14 a notice to individuals about the processing of Personal Data (PD) is provided that is clear, easy-to-understand and expresses information about Personal Data (PD) processing in plain language.
Assessment rigor: 3
Origin: 53A_R5_PT-05b. - PRI-21_A15 a notice to individuals about the processing of Personal Data (PD) that identifies the authority that authorizes the processing of Personal Data (PD) is provided.
Assessment rigor: 3
Origin: 53A_R5_PT-05c. - PRI-21_A16 a notice to individuals about the processing of Personal Data (PD) that identifies the purpose for which Personal Data (PD) is to be processed is provided.
Assessment rigor: 3
Origin: 53A_R5_PT-05d. - PRI-21_A17 a notice to individuals about the processing of Personal Data (PD) which includes information is provided.
Assessment rigor: 3
Origin: 53A_R5_PT-05e.
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | Data Privacy Notice |
- Secure Controls Framework -
The Secure Controls Framework® (SCF)
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.