06. Governance and Compliance Exercise

Governance and Compliance Exercise

As you learned during the lesson, Governance establishes authority, management, and decision making related to information systems and data. The different types of policy documents set the rules all need to follow or at least be aware of.
Udacity uses Governance for its users so you know their rules and expectations. These are often required by government regulators to be compliant with data security and privacy laws. In this exercise, we'll explore some of the Udacity policies on their legal website: https://www.udacity.com/legal.
On that website, click on Udacity's Terms of Use, which sets the rules for using Udacity's website and services and answer the quiz questions below.

Security and Privacy Professionals need to be very knowledgeable about the different types of Policies and how they are used. I encourage you to explore Udacity's policies as an example.

Udacity Terms of Use

From Udacity's Terms of Use (ToU), under the Access and User Accounts section, which term means that you have created a User Account (defined below) registered and have enrolled in and paid for access to the Online Courses and other Udacity’s Services and/or services.
SOLUTION: A Student

Udacity's Terms of Use

Udacity's Terms of Use (ToU), under the User Conduct Policy, what are you prohibited from posting, uploading or transmitting through Udacity's services (aka "unauthorized content")? Select all that apply.

SOLUTION:
  • Any communication that is obscene, fraudulent, indecent, or libelous or that defames, abuses, harasses, discriminates against or threatens others
  • Any communication that contains malicious software (aka malware)
  • Any communication that infringes the copyright, patent, trademark, trade secret, right of publicity, or other intellectual property or proprietary right of any third party; that violates

Exploring Udacity's Privacy Policy

QUESTION:

In this exercise, we'll explore Udacity's Privacy policy. It explains how we treat the information collected and received from your use of our Services (as defined in our Terms of Use or “ToU”) provided through the website, http://www.udacity.com and any other websites or applications we own, operate, or control (the “Website(s)”).

Step 1: Go to Udacity's Privacy Policy website.

Step 2: In the answer box, list at least three items for each:

  • Types of information Udacity collects from users
  • How Udacity collects the information from users
  • How Udacity uses the information we collect
ANSWER:

Udacity's Privacy Policy is comprehensive in stating the information it collects, how it collects it, and how it uses that information.

Sample answers for each question are below:

  • Types of information Udacity collects from users
  • Name, address, telephone number and email address
  • Log-in credentials, if you register a User Account with us
  • Information about purchases or other transactions with us, such as your shipping address.
  • Information about your customer service and maintenance interactions with us
  • Demographic information, such as your gender, socio-economic status, and other personal information
  • How Udacity collects the information from users
  • Using any of our Services, including registering for a User Account through the Website(s)
  • Making a purchase from us, including registering and enrolling in any Online Course
  • Signing up for email updates
  • Uploading or posting to public forums included through the Services
  • Submitting requests or questions to us via forms or email
  • How Udacity uses the information we collect
  • Send you information in connection with the Services
  • Respond to your communications and requests
  • Manage and process Online Courses
  • Contact you by email, postal mail, or phone (including via SMS messages) regarding Udacity and third-party products, services, surveys, research studies, promotions, special events, and other subjects
  • Help us better understand your interests and needs, and improve the Services
  • Engage in analysis, research, and reports regarding use of the Services
  • Secure the Services
  • Comply with any procedures, laws, and regulations

Next Concept