CGSP case studies
CGSP · Put your knowledge to work in context.
The Certified Governance, Security and Privacy Professional (CGSP) is a vendor-neutral credential for practitioners who sit where compliance, security and privacy overlap: GRC analysts and managers, privacy officers, security architects, data stewards, internal auditors and consultants advising on these topics. It signals that the holder can reason across the three disciplines rather than treat them as separate silos, which is exactly what regulators and business partners now expect. The CGSP case studies are 5 cases and about 3,889 words.
1Third-Party SaaS: Risk Acceptance or Termination?
Meridian Asset Management (MAM), a $2.3B AUM firm, relies on a cloud-based portfolio management SaaS (PortCloud) for trade settlement and client reporting. PortCloud's latest SOC 2 Type II report contains a qualified opinion on availability due to a 6-hour outage last quarter.
818 words, about 4 min2The Unpatchable MRI Controller
Regional Medical Center (RMC) operates 14 MRI machines running Windows 7 Embedded, which the vendor will not patch due to FDA certification. A new ransomware variant exploits SMBv1 and has breached three hospitals in the region.
699 words, about 3 min3AI Hiring Tool: Bias and GDPR Compliance
EuroRetail, a 5,000-employee retailer, deployed an AI-powered CV screening tool from a US vendor. The tool uses historical hiring data and claims 92% accuracy in predicting 'successful hires.' A works council complaint alleges the tool automatically rejects candidates over 50 and those with disabilities.
826 words, about 4 min4Merger of Customer Definitions
Two banks, AlphaBank and BetaBank, merged to form Northern Union Bank. AlphaBank defined 'customer' as any individual with an active account; BetaBank defined it as any party with a signed product agreement in the last five years.
775 words, about 4 min5The Ransomware Cover-Up
During a routine internal audit of incident management at HealthCo, auditor Maya discovers that a ransomware attack six weeks ago encrypted 200 GB of patient billing data. The CISO reported to the board that the incident was 'contained with no data exfiltration.' However, Maya's forensic review finds evidence that 200 GB was uploaded to an external IP address before encryption.
771 words, about 4 min