Cyber Wiki Learning Path
Governance, Privacy, and Resilience
Connect technical decisions to risk, data handling, continuity, recovery, retention, and accountable governance.
Recommended Sequence
80 connected entries
AI Audit Analytics
AI audit analytics applies reproducible queries, statistics, visualizations, and anomaly detection to evaluate populations and focus testing without replacing professional judgment.
AI data security · IntermediateAI Data Lifecycle Security
AI data lifecycle security protects information during collection, labeling, storage, use, sharing, retention, and deletion.
AI privacy governance · AdvancedAI Data Rights and Deletion
AI data-rights and deletion processes handle access, correction, objection, restriction, portability, and erasure across datasets, models, embeddings, caches, logs, and derived outputs.
AI life-cycle assurance · AdvancedAI System Decommissioning Assurance
AI system decommissioning assurance verifies that retired models, endpoints, data, credentials, integrations, copies, and monitoring obligations are removed or transferred as approved.
Agile delivery · IntermediateAgile Metrics Selection
Agile metrics selection chooses a small set of measures that support decisions about value, flow, quality, predictability, learning, risk, and sustainability.
Privacy engineering · AdvancedAnonymization and De-identification
Anonymization and de-identification reduce the ability to associate released or shared data with a specific person, while accounting for linkage and re-identification risk.
Resilience practice · BeginnerBackup and Recovery Strategies
Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.
Resilience discipline · IntermediateBusiness Continuity and Recovery
Business continuity and recovery prepare an organization to maintain essential functions, operate through disruption, and restore dependable services at an acceptable level.
Resilience planning · FoundationalBusiness Impact Analysis
A business impact analysis identifies essential activities, dependencies, outage consequences, and recovery priorities so continuity and disaster-recovery plans reflect business needs.
Resilience practice · IntermediateCloud Backup and Recovery
Cloud backup and recovery preserve restorable copies of data, configuration, and system state so services can recover after error, attack, corruption, or loss.
Data governance practice · IntermediateCloud Data Classification and Discovery
Cloud data classification and discovery identify where sensitive or regulated information exists and apply handling rules according to value, harm, and obligation.
Data governance practice · AdvancedCloud Data Governance
Cloud data governance assigns ownership and rules for classification, access, quality, lineage, retention, location, sharing, and disposal across cloud data services.
Data governance concept · AdvancedCloud Data Residency and Sovereignty
Data residency concerns where data is stored or processed, while data sovereignty concerns the legal authority that may apply to that data and its providers.
Operational capability · IntermediateCloud Resilience
Cloud resilience is the ability to prepare for, withstand, recover from, and adapt to disruption while preserving important services and acceptable outcomes.
Cloud detection practice · AdvancedCloud Storage Exfiltration Detection
Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.
Vision AI · FoundationalComputer Vision Systems
Computer vision systems extract patterns from images or video to classify, detect, segment, track, or generate visual content.
Privacy operations practice · IntermediateConsent Management
Consent management records, enforces, and updates a person's choices about defined data uses where consent is the appropriate basis or control.
Privacy rights operations · IntermediateConsent Withdrawal and Preference Operations
Consent withdrawal and preference operations propagate a person’s choice across interfaces, profiles, downstream systems, vendors, and future processing.
Privacy data governance · AdvancedCross-Border Data Flow Inventory
A cross-border data-flow inventory identifies where personal data originates, transits, is accessed, is stored, and is supported across jurisdictions and legal entities.
Cryptographic control practice · AdvancedCryptographic Key Management
Cryptographic key management governs key generation, registration, distribution, storage, use, rotation, backup, recovery, revocation, archival, and destruction.
Privacy engineering · IntermediateDark Pattern Review
A dark pattern review tests whether interface structure, language, defaults, repetition, friction, or visual emphasis steers people away from a free and informed privacy choice.
Data governance practice · BeginnerData Classification
Data classification assigns meaningful categories to information so protection, access, retention, sharing, monitoring, and disposal can be aligned with risk.
Information governance · FoundationalData Dictionaries and Metadata
Data dictionaries and metadata describe fields, formats, meanings, allowed values, ownership, sensitivity, and relationships so data can be interpreted consistently.
Privacy engineering · IntermediateData Flow Mapping for Privacy
Privacy data-flow mapping traces personal data from collection through transformation, use, storage, disclosure, archival, and deletion across trust and jurisdictional boundaries.
Privacy and data governance practice · IntermediateData Inventory and Mapping
A data inventory identifies important data assets, while data mapping shows where data comes from, how it moves, who uses it, where it is stored, and where it leaves the organization.
Data protection practice · IntermediateData Labeling and Security Tags
Data labeling and security tags attach machine-usable and human-readable handling context to information so access, movement, retention, and monitoring controls can act consistently.
Data governance concept · BeginnerData Lifecycle
The data lifecycle follows information through creation or collection, use, sharing, storage, archival, retention, and secure disposal.
Data governance · IntermediateData Lineage
Data lineage records how information moves from origin to destination, including transformations, joins, systems, owners, and reporting products.
Data protection control · IntermediateData Loss Prevention
Data loss prevention identifies and controls sensitive information as it moves through endpoints, networks, applications, cloud services, and storage locations.
Privacy principle · BeginnerData Minimization
Data minimization limits collection, use, sharing, precision, and retention to what is necessary for a defined and legitimate purpose.
Data governance practice · IntermediateData Ownership and Stewardship
Data ownership assigns accountability for decisions about a data domain, while stewardship performs or coordinates the day-to-day practices that maintain quality, protection, access, and lifecycle rules.
Third-party privacy · AdvancedData Processing Agreement Controls
Data processing agreement controls translate privacy obligations into enforceable purpose, instruction, security, rights, retention, transfer, incident, audit, and exit requirements.
Privacy data governance · IntermediateData Processing Inventory
A data processing inventory records how personal data is collected, used, stored, shared, retained, protected, and governed across business activities and systems.
Information governance · IntermediateData Provenance
Data provenance establishes the origin, custody, processing history, and authoritative context of a data item or dataset.
Data governance · FoundationalData Quality Dimensions
Data quality dimensions provide a repeatable way to judge whether information is complete, accurate, consistent, timely, valid, and fit for its intended use.
Records governance · IntermediateData Retention and Legal Holds
Data retention and legal holds govern how long information is kept, when normal disposal must pause, and how records remain discoverable and protected.
Privacy operations practice · IntermediateData Subject Rights
Data subject rights are mechanisms through which individuals may request access, correction, deletion, restriction, portability, objection, or other actions under applicable rules and promises.
Reporting assurance · IntermediateData Visualization Integrity and Accessibility
Data-visualization integrity and accessibility ensure charts, dashboards, maps, and reports represent data honestly and can be understood and operated by intended audiences, including people with disabilities.
Detection engineering · AdvancedDatabase Activity Monitoring
Database activity monitoring analyzes database sessions and commands to identify suspicious access, policy violations, misuse, and operational anomalies.
Database resilience · IntermediateDatabase Backup Verification
Database backup verification confirms that backup files are complete, readable, protected, and capable of restoring the intended database state.
Database resilience · AdvancedDatabase Point-in-Time Recovery
Point-in-time recovery combines a consistent base backup with ordered transaction logs so a database can be restored to a selected moment before an error or attack.
Privacy rights operations · IntermediateDeletion Verification and Exceptions
Deletion verification confirms that approved deletion reaches active systems, derived stores, archives, vendors, and future restoration paths while preserving documented legal exceptions.
Privacy engineering · AdvancedDifferential Privacy Deployment
Differential privacy deployment uses a quantified privacy-loss model, controlled query or release mechanisms, and implementation safeguards to limit what outputs reveal about individuals.
Information management practice · IntermediateInformation Governance
Information governance directs how information is created, classified, owned, used, shared, protected, retained, and disposed to support enterprise objectives and obligations.
Information governance practice · IntermediateInformation Governance and Data Stewardship
Information governance establishes decision rights and policies for the value, quality, security, privacy, retention, use, and disposal of information.
Data governance · IntermediateMaster Data and the Source of Truth
Master-data management defines authoritative records for shared entities and governs how duplicates, conflicts, reference values, and downstream copies are resolved.
Resilience planning · FoundationalMaximum Tolerable Downtime
Maximum tolerable downtime is the longest disruption a business process can endure before consequences become unacceptable.
Control catalog · AdvancedNIST SP 800-53
NIST SP 800-53 provides a broad catalog of security and privacy controls that organizations can select, tailor, implement, assess, and monitor according to risk and requirements.
Operational technology resilience · AdvancedOT Recovery and Process Safety
OT recovery restores trustworthy control, visibility, configuration, data, and operations in a sequence that protects people, environment, equipment, and process stability.
Service management · IntermediatePCI Data Retention and Secure Purge
PCI data retention and secure purge limit payment account data to documented business or legal need and remove it reliably from production, logs, backups, archives, endpoints, exports, and provider systems when no longer required.
Privacy assurance · AdvancedPrivacy Audit Evidence Management
Privacy audit evidence management preserves relevant, reliable, traceable, and access-controlled records so an independent reviewer can reconstruct what a control did and when.
Privacy incident operations · AdvancedPrivacy Breach Assessment Workflow
A privacy breach assessment workflow applies defined facts, legal tests, risk factors, and approval authority to decide whether an event requires notification or another response.
Privacy program operations · IntermediatePrivacy Complaint Intake and Resolution
Privacy complaint operations provide a controlled path to receive, classify, investigate, resolve, communicate, and learn from concerns about personal-data handling.
Privacy assurance · AdvancedPrivacy Control Effectiveness Testing
Privacy control effectiveness testing evaluates whether a control is appropriately designed, implemented, and operating consistently enough to achieve its stated objective.
Privacy engineering · IntermediatePrivacy Data Classification
Privacy data classification groups personal data by sensitivity, identifiability, context, legal constraints, and potential impact so handling controls can be applied consistently.
Privacy program operations · IntermediatePrivacy Governance Operating Model
A privacy governance operating model describes how oversight, policy, execution, assurance, escalation, and reporting work together across centralized and distributed teams.
Privacy risk assessment · IntermediatePrivacy Impact Assessment
A privacy impact assessment examines how a system, process, or change affects individuals and how privacy risks will be managed.
Incident response practice · IntermediatePrivacy Incident Management
Privacy incident management addresses events that may harm individuals or violate expectations for how personal information is handled.
Privacy program operations · IntermediatePrivacy Notice Change Management
Privacy notice change management keeps public and internal disclosures synchronized with actual collection, use, sharing, retention, automation, and rights practices.
Privacy program operations · IntermediatePrivacy Policy and Control Hierarchy
A privacy policy and control hierarchy connects principles and policy statements to standards, procedures, technical requirements, evidence, and accountable owners.
Privacy program operations · IntermediatePrivacy Program Charter
A privacy program charter states the program’s mandate, scope, authority, decision rights, priorities, and reporting obligations in terms that leaders and operators can use.
Privacy assurance · IntermediatePrivacy Program Maturity Assessment
A privacy program maturity assessment evaluates how consistently governance, processes, people, technology, evidence, and improvement operate across the organization.
Privacy governance practice · IntermediatePrivacy Program Metrics
Privacy program metrics show whether privacy obligations, controls, and outcomes are improving, deteriorating, or requiring a decision.
Privacy program operations · IntermediatePrivacy Regulatory Change Monitoring
Privacy regulatory change monitoring identifies relevant legal, regulatory, and enforcement changes and translates them into scoped program, product, contract, and control updates.
Privacy rights operations · IntermediatePrivacy Rights Request Deadline Management
Privacy rights request deadline management converts jurisdictional timing rules and internal service targets into tracked milestones, dependencies, escalation, and proof of completion.
Privacy rights operations · IntermediatePrivacy Rights Request Verification
Privacy rights request verification confirms that a requester is entitled to act without collecting excessive new data or exposing another person’s information.
Privacy risk assessment · AdvancedPrivacy Risk in Mergers and Divestitures
Privacy risk in mergers and divestitures arises when data, systems, notices, permissions, vendors, obligations, and controls are combined, separated, transferred, or retired.
Privacy program operations · IntermediatePrivacy Role Accountability Matrix
A privacy role accountability matrix assigns who is responsible, accountable, consulted, and informed for recurring privacy decisions and control activities.
Privacy engineering · AdvancedPrivacy Runtime Monitoring
Privacy runtime monitoring detects when deployed processing diverges from approved purpose, data scope, access, destination, retention, consent, or user-choice expectations.
Privacy engineering · AdvancedPrivacy Threat Modeling
Privacy threat modeling identifies how data processing can create surveillance, linkability, identification, disclosure, exclusion, loss of control, or other adverse consequences.
Privacy engineering · IntermediatePrivacy Usability Testing
Privacy usability testing evaluates whether people can notice, understand, choose, change, and verify privacy-relevant actions without coercion or unnecessary effort.
Core terminology · FoundationalPrivacy and Security
Privacy governs appropriate processing of personal information and effects on people, while security protects information and systems from unauthorized access, change, disclosure, loss, and disruption.
Privacy engineering principle · IntermediatePrivacy by Design
Privacy by Design integrates privacy objectives into requirements, architecture, defaults, workflows, testing, and operations rather than adding notices after deployment.
Privacy engineering technology · AdvancedPrivacy-Enhancing Technologies
Privacy-enhancing technologies reduce exposure or enable useful processing with less disclosure, linkage, or centralized access to personal data.
Privacy engineering · AdvancedPrivacy-Preserving Machine Learning
Privacy-preserving machine learning applies technical and governance measures to limit exposure of personal or sensitive information during training, evaluation, inference, and sharing.
Project management · IntermediateProject Ethics and Professional Conduct
Project ethics and professional conduct guide decisions involving responsibility, respect, fairness, honesty, resources, people, data, suppliers, and the environment.
Project management · IntermediateProject Knowledge Transfer
Project knowledge transfer prepares people and organizations to operate, support, govern, and improve a delivered capability after project work changes hands.
AI security concept · IntermediatePrompt Injection and Agentic AI Risk
Prompt injection attempts to influence an AI system through untrusted instructions, while agentic risk grows when a model can use tools, retrieve data, or take actions beyond producing text.
AI and data governance · AdvancedSynthetic Data Governance
Synthetic data governance evaluates how generated records are produced, validated, labeled, shared, and protected, including whether they preserve sensitive patterns or distort intended use.
Third-party risk practice · IntermediateThird-Party Privacy Risk
Third-party privacy risk arises when suppliers, partners, processors, platforms, or data recipients handle personal information on an organization’s behalf or for a shared purpose.