Question

A privacy solutions engineer is building a privacy risk register for a new customer-loyalty platform. The team has identified a risk that a misconfigured API could expose customer purchase histories. Before recommending any controls, the engineer wants to prioritize this risk consistently against others in the register. Which approach BEST supports consistent prioritization of this identified privacy risk?

Accepted Answer

Score the inherent risk by evaluating the likelihood of the threat exploiting the vulnerability and the impact to data subjects, before considering existing controls

Answer

Immediately implement API authentication controls and record the risk as mitigated in the register

Answer

Rank the risk based solely on the volume of records the API can return, since larger datasets always represent higher risk

Answer

Defer scoring until a data protection authority provides guidance on acceptable API exposure thresholds