QuestionPro Survey - Privacy_Breach

100%

Privacy Breach Index

Dear Participant,

Has your organization provided notification of a data breach? If you sent notification about the loss or theft of personal information entrusted to you, were you satisfied with the steps your organization took to complete the incident response process? The first two parts of this survey focuses on how well you believe your organization responded to a recent data breach. Part three asks how important you believe certain attributes are in preventing and responding to a data breach.

We appreciate your frank responses to all survey questions. Please be assured that we will not collect any personally identifiable information. If you have any questions, contact Ponemon Institute at research@ponemon.org or call us at 1.800.887.3118.

Thank you in advance for your participation.

Dr. Larry Ponemon
Chairman

Key Definitions

Data breach victim is defined as the individual or household receiving notification that their personal information was either lost or stolen.

Personal information is information about a natural person, household or family. This information includes name, address, telephone numbers, e-mail address, Social Security number, other personal identification numbers, access codes, age, gender, income and tax information, shopping information, account activity and any other sensitive pieces of data about an individual.

Please respond to all questions based on your most recent incident requiring data breach notification

Q1 What type of personal information was lost or stolen in this breach incident?

Customer or consumer information

Employee, temporary employee or contractor information

Other (please specify):

Q2 What was the root cause of this data breach incident?

Q3 In your opinion, what grade would you assign to your organization’s overall performance in responding to the data breach incident?

A = Excellent

B = Good

C = Fair

D = Poor

E = Failure

Privacy Breach Index Questions

Prevention: Please answer each question listed below with a Yes, No or Unsure response. For each "Yes" response, please rate the importance of each control activity from very important to irrelevant.

Q4 Does your organization have policies describing how personal information should be protected from being lost or stolen?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q5 Does your organization have a training and awareness program available to customer service employees who might receive questions about privacy and data protection practices?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q6 Does your organization promptly change physical and electronic access rights of employees when they change jobs or are terminated?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q7 Does your organization practice strong authentication measures for granting employees and contractors access to its information systems?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q8 Are employees’ mobile devices (i.e. laptops, PDAs, cell phones) encrypted?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q9 Is the transmission of sensitive personal information encrypted?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q10 Does your organization regularly monitor its information systems for unusual traffic flow or other activity?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q11 Does your organization secure physical locations where personal information is stored?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q12 Are operating systems, applications and databases where data is stored and transmitted secured against intrusion?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q13 Do your employees have the ability to report data protection risks that might result in a data breach to appropriate supervisors or management personnel (upward communication)?

Yes

Unsure

If you answered "yes"

Very Important

Important

Sometimes important

Not important

Irrelevant

Q14 Does your organization verify that its privacy and security procedures can prevent a data breach?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q15 Does your organization conduct periodic risk assessments to determine where personal information is vulnerable to a data breach?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q16 Does your organization conduct periodic risk assessments of third parties, vendors or business partners that have access to its personal information?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q17 Are these risk assessments used to improve the security of sensitive or confidential information in your organization?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q18 Are data-bearing devices containing personal information disposed of in a secure manner?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Detection & Escalation: Please answer each question listed below with a Yes, No or Unsure response. For each "Yes" response, please rate the importance of each control activity from very important to irrelevant.

Q19 Is there a process in place to determine the potential harms experienced by victims as a result of the breach?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q20 Is there a function or leader responsible for managing the data breach incident?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q21 Has your organization established a cross-functional incident response team?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q22 Does your organization have enabling technology (such as DLP) to monitor potential data breaches?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q23 Are employees informed about how to report a data breach within the organization (upward communication)?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q24 Is there a process for restricting the release of information about the data breach incident (e.g., on a need to know basis only)?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q25 Are third parties, including contractors and business partners, instructed on how to inform your organization when they have a data breach involving your company's sensitive personal information?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q26 Does your organization have a special team assigned to investigate a data breach incident?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q27 Does your organization have internal specialized forensic tools and techniques in place to investigate a data breach?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q28 Is your organization's privacy leader involved in the detection and escalation process?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q29 As part of the assessment or forensic investigation, are conclusions developed, reviewed and approved by management?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q30 Are there standard operating procedures or protocols established for communicating relevant and appropriate information to law enforcement in the event of data theft or other criminal activity involving the breach incident?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Notification: Please answer each question listed below with a Yes, No or Unsure response. For each "Yes" response, please rate the importance of each control activity from very important to irrelevant.

Q31 Does your organization have a communications plan for notifying all appropriate regulatory authorities and law enforcement?

Yes

Unsure

If you answered "yes"

Very important

Important

Sometimes important

Not important

Irrelevant

Q32 Does your organization have a communications plan for notifying the media?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q33 Does your organization have a communications plan for employees who are responsible for responding to data breach victims?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q34 Does your organization have internal customer service and call center employees who respond to data breach victims' questions?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q35 Is there an existing contact channel (letter, email, phone call) to communicate with the data breach victim?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q36 Is there a process for verifying that contact with each data breach victim has been completed?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q37 Is there a process for managing incomplete or failed notification and contact returns?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q38 Is there a repository of standardized and approved communications available for use in advance of the incident?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q39 Is there a mechanism for receiving and tracking feedback about the quality and responsiveness of the organization to data breach victims?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q40 Is there a process for addressing special circumstances (i.e., disgruntled victims that require escalated management attention)?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q41 Is there a process for differentiating victims based on their personal information and accompanying exposure to ID theft or criminal activity?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q42 Is there a process for ensuring that all communications are done according to a pre-determined timeline?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q43 Is there a process for ensuring that communication about the breach is kept confidential until the company notifies victims and other stakeholders?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q44 Does your organization provide a website or link on your website for data breach victims to learn more about the data breach incident and remedies available to them?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q45 Does your organization provide free or subsidized identity protection services, including credit monitoring, to minimize harm to data breach victims?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q46 Does your organization offer more than one year of free credit monitoring to data breach victims?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q47 Is there some outreach effort to communicate the benefits of identity protection services to data breach victims?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q48 Does your organization purchase specialized insurance to reimburse for loss related to a data breach event?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q49 Does your organization fully document the incident response from initial discovery to disclosure?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q50 Is there subsequent communication or disclosure to data breach victims when new information about the breach event comes available?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Ex-post Response: Please answer each question listed below with a Yes, No or Unsure response. For each "Yes" response, please rate the importance of each control activity from very important to irrelevant.

Q51 Is there an assessment, audit or post-mortem procedure required after the incident is closed?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q52 Is there a final report to senior management or the board of directors?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q53 Is there a performance review of the incident response team conducted by management?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q54 Is there a process to make recommendations for improvement?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q55 Is there a training program for those who were responsible for the breach?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q56 Does your organization attempt to calculate the cost of the data breach?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q57 Is there a process to implement recommendations for privacy and data protection risk assessment programs?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q58 Is there a process to determine responsibility for the data breach incident?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Q59 Is there a process to determine appropriate actions and enforcement for non-compliance with policies?

Yes

Unsure

If you answered “yes”

Very important

Important

Sometimes important

Not important

Irrelevant

Organization Characteristics

Your current title is:

What organizational level best describes your current position?

Total years of business experience?

Total years in privacy or security?

Total years in current position?

Check the Primary Person you or your supervisor reports to within your organization.

Check the country or U.S. region where your company’s primary headquarters is located.

If in the United States, what state?

Educational and career background:

What is the approximate size of your IT department in terms of full-time equivalent (FTE) headcount?

What industry best describes your organization’s industry concentration or focus?

What best describes your role in managing privacy and data protection risks within your organization? Check all that apply.

Setting priorities

Managing budgets

Selecting vendors and contractors

Determining privacy and data protection strategy

Evaluating program performance

What is the worldwide headcount of your organization?

Ponemon Institute LLC Advancing Responsible Information Management
Ponemon Institute is dedicated to independent research and education that advances responsible information and privacy management practices within business and government. Our mission is to conduct high quality, empirical studies on critical issues affecting the management and security of sensitive information about people and organizations. As a member of the Council of American Survey Research Organizations (CASRO), we uphold strict data confidentiality, privacy and ethical research standards. We do not collect any personally identifiable information from individuals (or company identifiable information in our business research). Furthermore, we have strict quality standards to ensure that subjects are not asked extraneous, irrelevant or improper questions.