In this blog, we will focus on the importance of Governance, Risk Management, and Compliance (GRC) programs within the NIST Privacy Framework. Having an organizational governance structure increases the effectiveness and efficiency in privacy program management.
With increasing privacy regulations and evolving security threats, sound privacy governance is more important than ever.
Governance policies, processes and procedures
Formalizing and documenting the organization’s privacy values, roles and responsibilities must be in place to manage, monitor and inform management of privacy risk. The absence of mechanisms to establish and maintain formal privacy guidance can result in misalignment within the organization, resources not being allocated appropriately to fulfill objectives. These living documents are the building blocks of the privacy governance program that promote accountability and collaboration at all levels of the organization.
The following elements should be in place to maximize the value of this control area:
- Values and policies should include data processing use cases, retention periods, and individual concerns.
- Processes to ensure that privacy values are considered for all new systems, products, and services as well as current operations.
- Defined privacy roles and responsibilities.
- Legal, regulatory, and contractual privacy considerations.
- Governance and risk management policies, processes and procedures are updated to include privacy risks.
Risk management strategy
Capturing the organization’s priorities, constraints, risk tolerances, and assumptions is a critical process in supporting strategies to manage risk. It is important that the evaluation of privacy risk is current and reflects all current and planned data processing activities. The privacy risk management process and strategy should be integrated into the overall risk management activities of the organization.
Mature risk management strategies establish control capabilities that:
- Ensure organizational stakeholders have bought in.
- Risk tolerance is clear and supported by the organizational roles it plays in the data processing ecosystem.
Awareness and training
People and the roles they have in processing activities are key in managing privacy risk. The absence of consistent training efforts can result in a lack of alignment with organizational strategy and controls not executed effectively. The employees and third parties involved in data processing should be provided privacy awareness training at levels that are consistent with their role and organizational policies and values.
All levels of the organization should be included:
- The overall workforce
- Senior executives
- Privacy personnel
- Third parties
Monitoring and review
Policies, processes and procedures support the ongoing review and communication of the privacy posture and risk. The absence of a dynamic process for identifying and managing privacy risk reduces the effectiveness of the organization to put appropriate controls in place. Privacy governance is not a one-time exercise. It is continuous and includes:
- Formally re-evaluating privacy risk periodically and as changes to the business environment occur.
- Update and communicate any changes to privacy values, policies, or training.
- Ensuring that oversight and testing of compliance and privacy requirements occur.
- Mechanisms should be in place to communicate status of management of privacy risks.
- Mechanisms are in place to receive, analyze and respond to problematic data actions reported internally or externally. Lessons learned should be incorporated into policies, processes and procedures.
- Policies, processes, and procedures that track the life cycle of any complaints, concerns, questions from individuals.
How OpenText can help in your Govern function
Implementing and integrating privacy governance capabilities ensures alignment in mitigating risk associated with processing activities. It creates mechanisms for the organization to define strategy, roles, responsibilities, processes, and accountability for managing personal data. The absence of strong privacy governance programs can lead to increased compliance risk and reduced trust by employees, customers and business partners.
OpenText™ Professional Services offer multiple services to address Cyber Security and Privacy objectives, including Data Classification Services and Incident Response Documentation Reviews.
For more information on OpenText’s Risk and Compliance Services, please contact us.
