Privacy References and Guides - Revision history

Tomjones: /* For Organizations Doing Business Abroad */

2020-05-31T00:54:44Z

For Organizations Doing Business Abroad

← Older revision		Revision as of 00:54, 31 May 2020
Line 41:		Line 41:
	== For Organizations Doing Business Abroad==		== For Organizations Doing Business Abroad==
	* US Department of Commerce: Privacy Shield Summary [https://www.commerce.gov/privacyshield]		* US Department of Commerce: Privacy Shield Summary [https://www.commerce.gov/privacyshield]
	* [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/ Canada PIPEDA in ~~frief~~]		* [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/ Canada PIPEDA in brief]

	==Other References==		==Other References==

	[[Category:Privacy]]		[[Category:Privacy]]

Tomjones: /* For Organizations Doing Business in the EU */

2020-05-31T00:54:23Z

For Organizations Doing Business in the EU

← Older revision		Revision as of 00:54, 31 May 2020
Line 39:		Line 39:
	* NIST SP 800-53 "Recommended Security and Privacy Controls for Federal Information Systems and Organizations", Appendix J (Privacy Control Catalog) [http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf]		* NIST SP 800-53 "Recommended Security and Privacy Controls for Federal Information Systems and Organizations", Appendix J (Privacy Control Catalog) [http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf]

	== For Organizations Doing Business ~~in the EU~~ ==		== For Organizations Doing Business Abroad==
	* US Department of Commerce: Privacy Shield Summary [https://www.commerce.gov/privacyshield]		* US Department of Commerce: Privacy Shield Summary [https://www.commerce.gov/privacyshield]
			* [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/ Canada PIPEDA in frief]

	==Other References==		==Other References==

	[[Category:Privacy]]		[[Category:Privacy]]

Tomjones at 19:57, 17 March 2020

2020-03-17T19:57:06Z

← Older revision		Revision as of 19:57, 17 March 2020
Line 42:		Line 42:
	* US Department of Commerce: Privacy Shield Summary [https://www.commerce.gov/privacyshield]		* US Department of Commerce: Privacy Shield Summary [https://www.commerce.gov/privacyshield]

			==Other References==

			[[Category:Privacy]]
	~~''Check back on this page for updates and additional guidance posted by the IDESG~~ Privacy ~~Committee''~~

Tomjones: /* Regarding Privacy Risk Assessment */

2020-03-17T19:55:59Z

Regarding Privacy Risk Assessment

← Older revision		Revision as of 19:55, 17 March 2020
Line 24:		Line 24:

	== Regarding Privacy Risk Assessment ==		== Regarding Privacy Risk Assessment ==
			* [https://www.nist.gov/system/files/documents/2019/04/30/nist-informative-references-privacy-framework-discussion-draft.pdf NIST Informative References for NIST Privacy Framework: An Enterprise Risk Management Tool - Discussion Draft]
	* Draft NISTIR 8062: Privacy Risk Management for Federal Information Systems [http://csrc.nist.gov/publications/PubsDrafts.html#NIST-IR-8062]		* Draft NISTIR 8062: Privacy Risk Management for Federal Information Systems [http://csrc.nist.gov/publications/PubsDrafts.html#NIST-IR-8062]
	* MITRE Privacy Engineering Framework [http://www.mitre.org/publications/technical-papers/privacy-engineering-framework]		* MITRE Privacy Engineering Framework [http://www.mitre.org/publications/technical-papers/privacy-engineering-framework]

Omaerz: 93 revisions imported: Initial Upload of old pages from IDESG Wiki

2018-06-28T04:02:55Z

93 revisions imported: Initial Upload of old pages from IDESG Wiki

New page

'''This page is considered a living document. Please check back for updates from the PCC.'''

'''References listed in this section are provided as potential tools for helping organizations understand how to evaluate their system for alignment to the privacy requirements. References should be considered informative guides only.'''

New documents can be suggested for inclusion by emailing the Privacy Committee listserv.

== General ==
* NSTIC FIPPs [https://www.whitehouse.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf]
* Privacy By Design [https://www.ipc.on.ca/english/Privacy/Introduction-to-PbD/]
* AICPA Privacy Maturity Model [https://www.aicpa.org/InterestAreas/InformationTechnology/Resources/Privacy/GenerallyAcceptedPrivacyPrinciples/DownloadableDocuments/AICPA-CICA-Privacy-Maturity-Model-ebook.pdf]
* AICPA GAPP [http://www.aicpa.org/InterestAreas/InformationTechnology/Resources/Privacy/GenerallyAcceptedPrivacyPrinciples/DownloadableDocuments/GAPP_PRAC_ 0909.pdf]
* OASIS Privacy Management Reference Model [https://www.oasis-open.org/committees/pmrm/]
* PrivacyTrust.org Privacy Policy Requirements [http://www.privacytrust.com/certification/privacy/privacy_requirements.html]
* ArcGIS Global Privacy Requirements [https://blogs.esri.com/esri/arcgis/2015/10/12/global-privacy-requirements/]
* ISO/IEC 27018 Information technology -- Security techniques -- Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors [http://www.iso.org/iso/catalogue_detail.htm?csnumber=61498]
* ISO/IEC 29100 (2011) Privacy Framework [http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=45123]
* ITU IDM Requirements Document [http://www.itu.int/ITU-T/studygroups/com17/fgidm/]
* Microsoft-Trustworthy Computing, A guide to Data Governance for Privacy, Confidentiality and Compliance [https://www.microsoft.com/en-us/twc/privacy/data-governance.aspx]
* The Sedona Conference - Cloud Computing & Data Privacy [https://www.datenschutzzentrum.de/cloud-computing/20100617-cloud-computing-and-data-privacy.pdf]
* Privacy Impact Assessment Handbook [https://www.privacy.org.nz/news-and-publications/guidance-resources/privacy-impact-assessment-handbook/]
* Privacy and Biometrics: Building a Conceptual Foundation [http://www.biometrics.gov/docs/privacy.pdf]
* For issues related to clear communication with users (expectation-setting, communicating changes or updates, policy-writing, etc.), please see the User Experience Requirements and Supplemental Guidance. [https://workspace.idesg.org/kws/public/document?document_id=443&wg_abbrev=FMO]

== Regarding Privacy Risk Assessment ==

* Draft NISTIR 8062: Privacy Risk Management for Federal Information Systems [http://csrc.nist.gov/publications/PubsDrafts.html#NIST-IR-8062]
* MITRE Privacy Engineering Framework [http://www.mitre.org/publications/technical-papers/privacy-engineering-framework]
* DHS Information Technology Sector Baseline Risk Assessment [https://www.dhs.gov/xlibrary/assets/nipp_it_baseline_risk_assessment.pdf]
* "The Role of Risk Management in Data Protection" Centre for Information Policy Leadership, Hunton & Williams [https://www.hunton.com/files/Uploads/Documents/Centre/Role_of_Risk_Management_in_Data_Protection.pdf]

== For Healthcare Organizations ==
* HIPAA Privacy Rule Information Page [http://www.hhs.gov/hipaa/for-professionals/privacy/]

== For Organizations Doing Business with the US Government ==
* FICAM Trust Framework Provider Assessment Package Application [https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t0000000TNKMAA4&field=File__Body__s]
* Privacy Certificate Guidance for Federal Grantees required by 28 CFR Part 22 [http://www.nij.gov/funding/humansubjects/pages/privacy-certificate-guidance.aspx]
* NIST SP 800-162: Attribute Based Access Control Definition and Considerations (2014) [http://csrc.nist.gov/publications/nistpubs/800-162/sp800_162_pre-publication.pdf]
* NIST SP 800-53 "Recommended Security and Privacy Controls for Federal Information Systems and Organizations", Appendix J (Privacy Control Catalog) [http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf]

== For Organizations Doing Business in the EU ==
* US Department of Commerce: Privacy Shield Summary [https://www.commerce.gov/privacyshield]

''Check back on this page for updates and additional guidance posted by the IDESG Privacy Committee''