The value proposition of a PIA is not understood by management is the greatest obstacle to conducting a PIA, as it may result in lack of support, funding, resources or commitment for the PIA process and outcomes. Management may not appreciate or recognize the benefits of a PIA, such as enhancing privacy protection, reducing privacy risks and costs, increasing customer trust and satisfaction, and complying with privacy laws and regulations. Management may also perceive a PIA as a burden, a delay or a hindrance to the system or project development and delivery. The other options are not as significant as the value proposition of a PIA is not understood by management as obstacles to conducting a PIA. Conducting a PIA requires significant funding and resources is an obstacle to conducting a PIA, but it may be overcome by demonstrating the return on investment or the cost-benefit analysis of a PIA. PIAs need to be performed many times in a year is an obstacle to conducting a PIA, but it may be mitigated by adopting a scalable or modular approach to PIAs that can be tailored to different types or levels of systems or projects. The organization lacks knowledge of PIA methodology is an obstacle to conducting a PIA, but it may be resolved by acquiring or developing the necessary skills, tools or guidance for performing PIAs1, p. 67-68 Reference: 1: CDPSE Review Manual (Digital Version)

Reference:
The primary objective of privacy incident response is to mitigate the impact of privacy incidents on the organization and the data subjects. Privacy incident response is a process that involves identifying, containing, analyzing, resolving, and learning from privacy incidents that involve personal data. Privacy incident response aims to reduce the harm and liability that may result from privacy incidents, such as reputational damage, regulatory fines, legal actions, or loss of trust. Privacy incident response also helps to improve the organization's privacy posture and resilience by implementing corrective and preventive measures.
While notifying data subjects impacted by privacy incidents may be a legal or ethical obligation, it is not the primary objective of privacy incident response. Rather, it is one of the possible steps or outcomes of the process, depending on the nature and severity of the incident. Similarly, reducing privacy risk to the lowest possible level or optimizing the costs associated with privacy incidents are desirable goals, but not the main purpose of privacy incident response.

A primary objective of performing a privacy impact assessment (PIA) prior to onboarding a new Software as a Service (SaaS) provider for a customer relationship management (CRM) system is to identify controls to mitigate data privacy risks, such as data breaches, unauthorized access, misuse or loss of data. A PIA would help to evaluate the potential privacy impacts of using a new SaaS provider for CRM data processing activities, such as collecting, storing, analyzing or transferring customer data, and to implement appropriate controls to mitigate those impacts, such as encryption, access control, backup, audit trail or contractual clauses. A PIA would also help to ensure compliance with privacy principles, laws and regulations, and alignment with customer expectations and preferences. The other options are not primary objectives of performing a PIA prior to onboarding a new SaaS provider for CRM data processing activities. Classifying personal data according to the data classification scheme is an activity that may be part of a PIA process, but it is not an objective in itself. Assessing the risk associated with personal data usage is an activity that may be part of a PIA process, but it is not an objective in itself. Determining the service provider's ability to maintain data protection controls is an activity that may be part of a PIA process, but it is not an objective in itself1, p. 67 Reference: 1: CDPSE Review Manual (Digital Version)

Reference:
To facilitate a robust data breach management response, an organization must have an inventory of affected individuals and systems, as this will help to identify the scope, impact and severity of the breach, and to take appropriate actions to contain, mitigate and notify the breach. An inventory of affected individuals and systems should include the following information:
The number and categories of data subjects whose personal data have been compromised The types and volumes of personal data that have been exposed, altered or deleted The sources and locations of the personal data, such as databases, servers, devices or third parties The potential or actual consequences of the breach for the data subjects, such as identity theft, fraud, discrimination or physical harm The systems and processes that have been compromised or affected by the breach, such as networks, applications, devices or security controls The vulnerabilities or risks that have been exploited or introduced by the breach, such as malware, phishing, ransomware or human error An inventory of affected individuals and systems will help the organization to assess the risk level of the breach, and to determine the appropriate response strategy and actions, such as:
Isolating or shutting down the affected systems or processes
Restoring or recovering the personal data from backups or other sources Erasing or encrypting the personal data on the compromised devices or media Analyzing the root cause and impact of the breach Reporting the breach to the relevant authorities and stakeholders Notifying the data subjects of their rights and remedies Implementing corrective and preventive measures to avoid future breaches Data Breach Preparation and Response in Accordance With GDPR - ISACA, section 4: "The controller should document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken." Cybersecurity Incident Response Exercise Guidance - ISACA, section 3: "The IRT should identify all assets involved in an incident (e.g., hardware, software) and determine what information was compromised (e.g., PII)." Guide to Securing Personal Data in Electronic Medium, section 3.5: "Organisations should maintain an inventory of personal data in their possession or under their control."

System hardening is a process of applying security measures and configurations to a system to reduce its attack surface and enhance its resistance to threats. System hardening can include disabling unnecessary services, removing default accounts, applying patches and updates, enforcing strong passwords and encryption, and implementing firewalls and antivirus software. The primary benefit of system hardening is that it increases system resiliency, which is the ability of a system to withstand or recover from adverse events that could affect its functionality or performance. The other options are not the primary benefits of system hardening, although they may be secondary benefits or outcomes. System hardening does not necessarily reduce external threats to data, as threats can originate from various sources and vectors. System hardening may reduce exposure of data, but only if the data is stored or processed by the system. System hardening does not eliminate attack motivation for data, as attackers may have different motives and incentives for targeting data. , p. 91-92 Reference: : CDPSE Review Manual (Digital Version)