MENU
Classify the following scenario as major or minor non-conformity.
''The organization has a very mature information security policy. Lately, the organization has realized the need to focus on protection of PI. A formal PI identification exercise was done for this purpose and a mapping of PI and security controls was done. The organization has also put in place data masking technology in certain functions where the SPI was accessed by employees of a third party. However, the organization is yet to include PI specifically in its risk assessment exercise, incident management, testing, data classification and security architecture programs.''
Suggested Answer: C
Get Premium DCPLA Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
43 comments · newest first
ED
Eden
10 months ago
Both major and minor, they’re halfway there but not fully compliant.
DU
Dulce
11 months ago
Definitely a major issue, they need to step up their game.
VI
Virgina
11 months ago
Wait, they haven't included PI in risk assessments? That's surprising!
CO
Corinne
11 months ago
I think it's minor since they have some controls in place.
NG
Ngoc
11 months ago
Sounds like a major non-conformity to me.
JI
Jillian
12 months ago
I feel like this could be a minor issue since they are taking steps to protect PI, but I’m not confident about that.
AV
Avery
12 months ago
It seems like they have some good measures in place, but the lack of PI in their risk assessment makes me think it could be both major and minor.
MY
Myra
12 months ago
I remember a practice question where the absence of key controls led to a major non-conformity, but I'm not entirely sure if this situation is the same.
FL
Florencia
1 year ago
I'm leaning towards this being a major non-conformity since they haven't included PI in critical areas like risk assessment and incident management.
MA
Maybelle
1 year ago
Interesting scenario. The organization seems to be on the right track, but the lack of PI integration in certain areas is concerning. I'll need to carefully weigh all the factors.
KR
Kris
1 year ago
This is a tough call. They've made progress, but still have gaps. I'll need to really think through the significance of the missing elements to decide if it's major or minor.
BE
Beth
1 year ago
Okay, they've got a mature security policy and have done some PI identification and protection, but are missing it in key areas. I'm leaning towards major non-conformity, but I'll double-check the criteria.
HO
Honey
1 year ago
Hmm, the organization has taken some good steps, but it sounds like they still have work to do to fully integrate PI protection into their processes. I'll need to weigh the positives and negatives.
CA
Carla
1 year ago
This seems like a tricky one. I'll need to carefully analyze the details to determine if this is a major or minor non-conformity.
MA
Maryln
2 years ago
I'm with Glendora on this one. Protecting PI should be a top priority, and not having it properly integrated into their security programs is a major issue. Time to step it up!
LY
Lynelle
2 years ago
Hmm, I'm going to go with 'Both Major & Minor' on this one. The organization has made some good progress, but still has work to do to fully integrate PI protection into their security practices.
GL
Glendora
2 years ago
I disagree. This seems like a major non-conformity to me. Failing to include PI in risk assessment, incident management, and other core security functions is a significant gap that needs to be addressed.
AL
Alishia
2 years ago
User 4: A) Major
MI
Mirta
2 years ago
User 3: C) Both Major & Minor
NA
Natalie
2 years ago
User 2: B) Minor
EL
Elly
2 years ago
A) Major
DE
Desmond
2 years ago
Agreed, this is a tough one. I can see both sides, but I think the fact that they've at least started the process with data masking and PI identification pushes it more towards 'Minor' in my book. Baby steps, people!
RE
Remona
2 years ago
Are we sure this isn't a trick question? It's almost too easy. Where's the catch?
MA
Marylou
2 years ago
B) Minor
LA
Lanie
2 years ago
It seems pretty straightforward to me.
NI
Nieves
2 years ago
A) Major
PE
Pearline
2 years ago
I see your point, but maybe it could also be considered a minor non-conformity since they have taken steps to protect PI in certain areas.
BR
Britt
2 years ago
I'm going with B. They've already made some good progress, even if they haven't finished the job yet.
DA
Danilo
2 years ago
User1: True, they're on the right track though.
TH
Theola
2 years ago
User3: I agree, but they still need to include PI in other areas like risk assessment and incident management.
FR
Francoise
2 years ago
Yeah, they've made some progress with the data masking technology.
ED
Edward
2 years ago
C) Both Major & Minor
LA
Latricia
2 years ago
I think it's a minor non-conformity.
TH
Theodora
2 years ago
B) Minor
DA
Darrel
2 years ago
A) Major
SE
Sean
2 years ago
I agree with Elly. Not including PI in risk assessment and incident management is a big risk for the organization.
CA
Carissa
2 years ago
I think this is a major non-conformity. The organization has a lot of work to do to properly protect PI.
RO
Rosendo
2 years ago
Hmm, this seems like a tricky one. I'm leaning towards C, but I'm not totally sure.
JO
Jody
2 years ago
It's definitely a mix of major and minor non-conformity.
TR
Trina
2 years ago
Maybe they should prioritize including PI in their risk assessment.
DO
Donte
2 years ago
I agree, it seems like there are important aspects missing.
IR
Irma
2 years ago
I think it could be both major and minor.
EL
Elly
2 years ago
I think it's a major non-conformity because PI should be included in all aspects of information security.