Competency Category:

Competency Series:

9.2 – Respond to Cybersecurity Breaches

Purpose & Context

Career Development Professionals (CDPs) report suspicious events or unusual activity when using organizational IT systems to a designated authority to determine if the incident is indicative of a security breach. A breach of security of safeguards involving personal information might result in potential harm to individuals whose personal information might have been accessed.All security breaches of personal information must be reported in compliance with data breach regulations. Affected individuals must be informed of situation as soon as possible, informed of what steps are being taken to reduce the risk of harm, and given guidance on actions required to mitigate possible further harm.

Effective Performance

Competent career development professionals must be able to:

P1. Recognize possible security incident, for example:
- Unusual login times
- Unexpected restarts
- Configuration changes with no previous approval
- Unexpected user account lockouts
- Passwords changes
- Repeated system or application crashes
- Abnormal behaviours during browsing
P2. Report suspected security breach to designated authority as per organizational policies and procedures
P3. Assess likelihood of risk of harm of affected individuals
P4. Document observed incidents:
- Date
- Circumstances
- Type of information at risk

Knowledge & Understanding

Competent career development professionals must know and understand:

K1. Legislation and regulations, e.g. Personal Information Protection and Electronic Documents Act (PIPEDA)
K2. Organizational policies and procedures relevant to security incidents

Contextual Variables

Competent career development professionals must be able to perform this competency in the following range of contexts:

There may be additional provincial/territorial reporting requirements depending on the CDP’s geographic location.

Glossary & Key References

Terms

Industry-specific terms contained in the standard defined here, where applicable.

None

Information Sources and Resources for Consideration

How to detect data breaches before it is too late. Accessed February 20, 2020. CCSI. https://www.ccsinet.com/blog/how-to-detect-data-breaches-before-its-too-late/

Context Rating Scales

Criticality

Q: What is the consequence of a professional being unable to perform this skill according to the standard?

High probability of risk: VERY CRITICAL

Frequency

Q: How frequent and under what conditions is this skill performed?

Unexpectedly, e.g. when emergency arises

Level of Difficulty

Q: Under routine circumstances, how would you rate the level of difficulty in performing this skill?

Moderate difficulty or complexity

Time Required to Gain Proficiency

Q: What is the average length of time or number of repeated events that are minimally necessary for an individual to become proficient in performing the skill to the standard?

A career development professional must complete required organizational training and refresher training to ensure comprehensive understanding of security policies and procedures as soon as possible upon onboarding. CDPs must take all measure to support a security culture within the organization.

Autonomy

Practitioners typically perform this competency without supervision, and as part of a team.

Automation

It is unlikely that this competency will automate.

Requisite Work Aids, Tools, Equipment or Materials

None

Our Purpose

Thank you for being a part of the Career Development Professional Centre. To ensure that all members have the best possible experience, we have a few ground rules that we ask everyone to adhere to. This code of conduct applies equally to every person in the community and is intended to foster an online space that is inclusive, safe, and welcoming to all.

Centre Rules

Be welcoming

We strive to be a place that welcomes and supports people of all backgrounds and identities. We aim to be a place that promotes excellence and innovation in career and workforce development. Please extend respect to all members; we all come from different backgrounds and levels of knowledge and there is no such thing as a stupid question.

Be respectful

We won’t all agree all the time, but when we disagree don’t let those disagreements turn into personal attacks. A place where people feel uncomfortable or threatened will not be a productive one. When having discussions in the online community, commenting on a library article, or participating in other Centre activities, strive for productive conversations around the content being presented, not the person behind the content. Any comments determined to be “hate speech” towards any individual or group will be deleted, and the user account may be locked until an investigation regarding the comment has been concluded. The user may be given a written warning or removed from the CPDC platform depending on the findings of the investigation.

Hate Speech could include and is not limited to:

Violent threats or language directed against another person

Discriminatory jokes, language, or materials

Defamatory or abusive language or materials

Profane or illegal materials

Advocating for, or encouraging, any of the above behavior

A good rule of thumb is to never say anything that you wouldn’t be comfortable with the world seeing or that you wouldn’t want anyone knowing came from you. We ask that you keep in mind the focus of this place, which is building excellence and innovation in career and workforce development for all individuals.

Be considerate of the purpose of the Centre

The Centre focuses on building excellence and discussing innovation in the career and workforce development field. The goal of the social learning community is to communicate goals, challenges, constructive feedback, and questions in relation to career and workforce development. The Centre should be a place for continued learning and development as well as a place to discuss the future of our field (solicitation without written consent by the Project or Advisory team, is strictly prohibited). Any post or comment that is determined to be soliciting any individual or group will be deleted, and the user account may be locked until an investigation regarding the post has been concluded. The user may be given a written warning or removed from the CPDC platform depending on the findings of the investigation.

Post your discussions or documents in the most appropriate group or topic

Especially within the social learning community, make reasonable efforts to ensure that posts and materials are allocated to the appropriate group or topic. This will prevent cluttering the feed and make it easier for everyone to find the information that they are seeking. Individuals who do this repeatedly will be contacted by one of the group admins and asked to follow these guidelines.