CISO Assistant Privacy

CISO Assistant manages privacy and data protection through the Processing module, which centralizes your Record of Processing Activities (ROPA) and serves as the foundation for Data Protection Impact Assessments (DPIAs). By integrating these privacy-specific objects with the platform's broader asset and risk engine, you can maintain continuous compliance with regulations like GDPR or the UK Data Protection Act.

1. Managing your ROPA (Record of Processing Activities)

The Processing domain is where you document every data processing activity within your organization. Each record serves as a "Processing" object that captures mandatory regulatory details.

• Core Documentation: For each activity, you define the Processing Nature (e.g., collection, storage, profiling), the purpose, and the Information/Usage Channels.1

• Data Subjects & Categories: You can explicitly mark if the processing involves Sensitive Personal Data.1

• Mapping to Assets: Crucially, you link these processing activities to your Supporting Assets (e.g., the specific database or SaaS tool where the data resides).1

• Ownership: Assign specific team members or a DPO as the Author or Assignee to ensure accountability for the accuracy of the record.1

2. Conducting DPIAs (Data Protection Impact Assessments)

CISO Assistant treats a DPIA as a specialized risk and compliance workflow triggered by your processing activities.

• Triggering a DPIA: Within the Processing record, you can flag "DPIA Required". This acts as a placeholder for your formal assessment reference.1

• Methodology: To conduct the assessment, you typically use the Compliance Assessment module with a dedicated privacy framework (e.g., the built-in CNIL GDPR Guide or the NIST Privacy Framework).1

• Risk Linkage: You can link the findings of your DPIA directly to Risk Scenarios. This allows you to model specific privacy threats—such as "Unauthorized Data Subject Access"—and calculate the residual risk after mitigations are applied.1

• Evidence Collection: For every requirement in the DPIA, you can attach Evidence (e.g., data flow diagrams or encryption policies) to prove that "Privacy by Design" principles are being met.1

3. Recommended Privacy Controls & Questions

Based on best practices for supplier and internal reviews, your privacy modules should address these key functional areas:

Privacy Area

Expected Documentation / Evidence

Data Subject Rights

Documented SLAs for responding to access, erasure, and portability requests.

International Transfers

Hosting locations and the specific transfer mechanisms (e.g., Standard Contractual Clauses).

Retention & Deletion

Automated retention schedules and certificates of secure deletion.

Sub-processors

A list of downstream processors and proof of their security due diligence.

Breach Notification

A documented process committing to notification within 24–72 hours.

4. Integration with X-Rays

The X-rays quality check feature automatically monitors your privacy assessments for common compliance gaps:1

• Missing Evidence: Flags processing activities marked as "Compliant" that lack an attached ROPA extract or DPIA outcome.

• Orphaned Processing: Identifies data processing activities that are not linked to any technical assets or security controls.

To import your existing Record of Processing Activities (ROPA) from a spreadsheet 

To import your existing Record of Processing Activities (ROPA) from a spreadsheet into CISO Assistant, you can use the Data Wizard via the web interface or the CLICA command-line tool.12

Step 1: Prepare Your Spreadsheet

The Data Wizard requires specific column headers to map your data correctly. Use the following fields in your Excel or CSV file:2

• name (Required): The name of the processing activity (e.g., "Employee Payroll Processing").2

• domain: The Folder or Domain name where the record should be stored.2

• ref_id: Your internal reference ID for the record.2

• description: A detailed summary of the processing activity.2

• status: The current lifecycle state of the record.2

• dpia_required: Enter "true" or "yes" if a DPIA is necessary.2

• processing_nature: Comma-separated list of activities (e.g., "collection, storage").2

• assigned_to: Comma-separated list of emails for those responsible for the record.2

• labels: Comma-separated tags for filtering (e.g., "HR, Finance").2

Step 2: Import via Data Wizard (UI)

1. Log in to your CISO Assistant instance.

2. Navigate to the Import section in the main sidebar.

3. Select "Import Processing" from the list of supported models.2

4. Upload your prepared file. The system will validate the rows and create the records in your designated Domain.2

Step 3: Import via CLICA (Command Line)

If you prefer using the command line for bulk operations, ensure you have CLICA installed and authenticated with your Personal Access Token (PAT).2

1. Configure Authentication: Ensure your .clica.env file contains your TOKEN and API_URL.2

2. Run the Import Command:

3. uv run clica.py import-processings --file your-ropa-data.xlsx --folder "Privacy Domain"

4. Replace "Privacy Domain" with the name or UUID of your target folder.12

Step 4: Post-Import Verification

• Review in UI: Go to the Processing module to verify all records were created successfully.2

• Check X-Rays: Navigate to the X-Rays dashboard to identify any imported records that are missing critical documentation or have orphaned assets.

Privacy Assessment Workflow & DPIA Guide

This guide outlines how to move from a documented Record of Processing Activities (ROPA) to a formal Data Protection Impact Assessment (DPIA) within CISO Assistant. This workflow ensures that privacy risks are quantified and mitigated in alignment with GDPR and UK Data Protection standards.

Step 1: Initialize the ROPA Record

Before starting a DPIA, ensure the activity is correctly documented in the Processing module.

1. Locate the Record: Open the Processing domain and select your newly imported activity (e.g., "Customer Marketing Analytics").

2. Define Processing Details:

   • Nature: Specify if this involves profiling, large-scale monitoring, or automated decision-making.1

   • Data Categories: Explicitly flag if Sensitive Personal Data (biometric, health, ethnic origin) is processed.1

3. Set the DPIA Flag: Check the "DPIA Required" box. This signals to the legal and security teams that a formal impact assessment is mandatory for this specific activity.1

Step 2: Launch the Compliance Assessment (DPIA)

CISO Assistant utilizes its compliance engine to run the DPIA as a structured questionnaire.

1. Select a Privacy Framework: Navigate to Compliance Assessments and create a new audit.

2. Framework Choice: Select the CNIL GDPR DPIA Guide or ISO/IEC 27701 from your imported libraries.2

3. Scope to Perimeter: Link the assessment to the same Perimeter where the processing activity occurs (e.g., "Production SaaS").2

4. Delegate Requirements: Use the Assignments page to delegate specific privacy questions (e.g., "Data Minimization") to the relevant Product or Data owners.1

Step 3: Privacy Risk Identification

A key part of a DPIA is modeling what could go wrong with the personal data.

1. Link Privacy Scenarios: In the Risk Assessment domain, create scenarios specific to the processing activity, such as:

   • Unauthorized Access to Patient Records.2

   • Data Breach due to Sub-processor failure.2

2. Link to Assets: Ensure these risks are linked to the Supporting Assets (databases/apps) identified in your ROPA.2

3. Evaluate Impact: Rate the impact based specifically on the rights and freedoms of the data subjects, rather than just organizational financial loss.2

Step 4: Evidence & Review

Auditors require proof that privacy-by-design is being practiced.

1. Attach Evidence: For each compliant requirement in the DPIA, attach artifacts such as:

   • Data Flow Diagrams.1

   • Data Processing Agreements (DPAs) with vendors.1

   • Anonymization or Encryption policies.1

2. Run X-Rays: Use the Evidence Integrity X-ray to ensure no privacy requirement is marked "Compliant" without a physical file or link to support it.1

Step 5: Final Approval & ROPA Linkage

1. Close the Assessment: Once reviewed, the Manager "Closes" the assignment.1

2. Update ROPA Status: Go back to the Processing record and update the DPIA Reference with the link or ID of the completed assessment.1

3. Ongoing Review: Set an Expiry Date on the privacy controls to ensure the DPIA is revisited whenever the processing nature changes.1

Privacy Evidence Requirements

To support your first DPIA within the platform, here is the detailed list of Privacy Evidence Requirements mapped against the core security and data protection areas. Use this checklist when reviewing artifacts uploaded by system owners or third-party suppliers to ensure your assessment meets regulatory audit standards.1

1. Data Protection & Processing Roles

• Context: Verifies the exact relationship and legal boundaries between your organization and any supporting entities.1

• Mandatory Evidence:

  • A fully executed Data Processing Agreement (DPA) outlining standard contractual clauses.2

  • A clear architectural diagram defining data flow boundaries (e.g., distinguishing between Controller, Processor, and Sub-processor nodes).2

2. Processing Nature & Data Minimization

• Context: Ensures that only necessary data is processed and that the processing matches your declared business purpose.1

• Mandatory Evidence:

  • A data schema or Data Dictionary detailing the precise categories of data subjects and fields collected (specifically highlighting sensitive categories like financial or biometric records).12

  • System configuration screenshots demonstrating that fields not required for the primary business purpose are either omitted or disabled by default.

3. Data Retention, Secure Deletion, & Exit

• Context: Prevents "permanent data hoarding" and ensures compliance with data lifecycle mandates.13

• Mandatory Evidence:

  • An officially approved Corporate Data Retention Schedule explicitly defining timelines for the processing activity.24

  • Technical proof of enforcement (e.g., database scripts for automated deletion, retention policy configurations in cloud storage, or third-party certificates of certified destruction).24

4. International Data Transfers & Boundaries

• Context: Confirms that personal data remains within legally recognized or safeguarded geographic boundaries.12

• Mandatory Evidence:

  • A production infrastructure layout or cloud service report verifying the specific Geographic Hosting Locations of primary databases and backup arrays.23

  • A documented Transfer Impact Assessment (TIA) if any support teams or data nodes reside outside the UK or EEA.23

5. Technical Safeguards (Privacy by Design)

• Context: Provides independent assurance that data is actively protected while at rest, in use, and in transit.14

• Mandatory Evidence:

  • Encryption at Rest: Configuration logs proving AES-256 full-disk or field-level database encryption for sensitive fields.4

  • Encryption in Transit: TLS 1.2/1.3 enforcement profiles and recent network configuration audits prohibiting legacy protocols (such as SSL or TLS 1.0).4

  • Data Masking: Evidence of anonymization or pseudonymization scripts applied to data streams copied into non-production or test environments.24

6. Incident Response & Breach Notification

• Context: Ensures the organization can meet strict regulatory windows (such as the GDPR 72-hour notification threshold) in the event of a breach.12

• Mandatory Evidence:

  • A documented Incident Response Plan (IRP) featuring dedicated workflows and escalation paths for personal data breaches.24

  • The formal report or output summary from your most recent incident response Tabletop Testing Exercise.4

DPIA Executive Approval Summary

Document Reference: DPIA-{{ $node["CISO_Assistant_Node"].json["ref_id"] }}

Reviewer: Information Security Team / DPO

Approval Status: Pending Executive Sign-Off

Target Perimeter: {{ $node["CISO_Assistant_Node"].json["perimeter_name"] }}1

1. Executive Summary

This summary provides an executive evaluation of the Data Protection Impact Assessment (DPIA) conducted within CISO Assistant for the processing activity: "{{ $node["CISO_Assistant_Node"].json["name"] }}".

The assessment was performed using the CNIL GDPR DPIA / ISO 27701 Framework to ensure compliance with formal privacy mandates. While technical safeguards are partially deployed, a critical contractual constraint has been identified that prevents full remediation of supply chain privacy risks.12

2. Privacy Risk & Impact Analysis

The mapping engine has aggregated technical vulnerabilities and privacy gaps into a strategic business risk scenario: "Critical Supply Chain Data Leak via Vendor X."2

• Inherent Risk Score: High (Based on processing sensitive personal data fields)

• Current Control Strength: Ineffective / Blocked (Due to external constraints)2

• Residual Risk Level: High2

Critical Operational Constraint:

Technical assessments indicate critical gaps in downstream supply chain governance. Due to legacy procurement boundaries, no contractual or legal levers currently exist under UK Law to mandate technical privacy corrections by the provider. This creates a structural bottleneck where technical remediation is blocked at the commercial layer.2

3. Consolidated Evidence Audit

Before granting final processing approval, the following primary evidence artifacts have been logged and verified against the platform's X-Rays data integrity engine:

• Data Processing Agreement (DPA): Executed, but missing enforceable technical performance clauses.12

• Geographic Boundaries: Hosting locations verified within the UK/EEA perimeter.1

• Encryption Standards: Full-disk AES-256 encryption confirmed on primary databases.1

• Data Minimization: Field-level masking active in non-production environments.1

• Incident Management: Incident Response Plan (IRP) exists; however, the supplier's commitment to the 72-hour regulatory breach notification window is unverified.1

4. DPO Recommendations & Board Action Required

To align the processing activity with the organization's Information Security Policy and legal obligations, senior management must execute one of the following decisions:12

• Action 1: Formal Risk Acceptance: Formally accept the residual privacy risk exposure for the current fiscal cycle, subject to quarterly review via the platform's Exception handling domain.12

• Action 2: Commercial Restructuring: Instruct Legal and Procurement teams to initiate a contract addendum enforcing standard privacy clauses and verification rights.12

• Action 3: Deploy Shielding Controls: Implement additional compensating encryption layers internally before data is transmitted to the third-party infrastructure.12

5. Automated Data Syndication (SIEM Audit Trail)

In alignment with Tier 4 Enterprise Security Requirements, this strategic risk event and its final approval status will be automatically synchronized:

1. Pushed to the corporate Enterprise Risk Management (ERM) tool via an optimized n8n filter loop.2

2. Exported via a 15-minute delta extraction loop to a secure, isolated S3 bucket for native SIEM ingestion, ensuring a complete and unalterable audit trail.1