Member Records and the Exam Item Bank: A Walkthrough for Protecting What an Association Holds

A certification association holds two kinds of things other people would like to have: member and candidate records (names, contact details, payment history, exam results) and its own work, from the exam item bank to course slides and unpublished drafts of a standard. This walkthrough builds a written plan for both, in the order the decisions come up. It is general information, not legal advice, and none of the sources behind it promises that these steps will prevent theft.

1. List what you hold, and why you hold it

Start with one row per kind of record and one column for the reason the association keeps it. NIST SP 800-122 was prepared for federal agencies and says it “may be used by nongovernmental organizations on a voluntary basis.” It treats as personal information anything that can distinguish or trace a person’s identity, plus information “linked or linkable” to a person. It also asks organizations to weigh “the context of use,” meaning the purpose for which the data is collected, stored, used or disclosed. A member’s name in the public directory and the same name on a failed exam result are not the same risk. The FTC’s guide for business builds its plan on five principles, the first of which is “TAKE STOCK.”

2. Cut the fields and files nobody needs

The next of the FTC guide’s principles is “SCALE DOWN,” and it is blunt: “If you don’t have a legitimate business need for sensitive personally identifying information, don’t keep it. In fact, don’t even collect it.” NIST SP 800-122 says the same in its own words, that the likelihood of harm from a breach “is greatly reduced” when an organization minimizes the personal information it uses, collects and stores. In practice that means asking why the conference registration form wants a birth date, and why exam candidates’ identification scans are still on a shared drive years after their scores posted. When a small office worries about what this will cost, the FTC’s answer begins: “There’s no one-size-fits-all approach to data security.”

3. Narrow who can open each record

Least privilege is the plain idea that people see only what their job needs. NIST SP 800-53’s controls are mandatory for federal information systems, and the publication says they “can be implemented within any organization or system that processes, stores, or transmits information.” Its control AC-6 calls for allowing “only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.” Test it on the chapter leader who can export the national roster, the volunteer item writer who can browse the whole item bank, and the former staff member whose login still works.

4. Decide what stays secret and what gets published

Under 18 U.S.C. 1839, information is a trade secret only if its owner “has taken reasonable measures to keep such information secret” and it derives independent economic value “from not being generally known to, and not being readily ascertainable through proper means by, another person”; the same section says reverse engineering and independent derivation are not improper means. Section 1836 lets the owner of a misappropriated trade secret bring a civil action when the secret relates to a product or service used in interstate or foreign commerce.

The limit is stated by the Supreme Court in Ruckelshaus v. Monsanto: when someone discloses a trade secret to people under no duty to keep it confidential, “or otherwise publicly discloses the secret, his property right is extinguished.” Publishing or teaching something openly ends trade-secret protection for whatever was disclosed. So the line drawn in this step runs between material the association keeps confidential and material it publishes or teaches, since only the first can meet the statute’s secrecy test. What covers the published material is a different set of tools, explained in our article on sharing materials while protecting the mission.

5. Put the terms where people will actually see them

Many member portals rely on a “terms of use” link in the footer. In Nguyen v. Barnes & Noble, the Ninth Circuit held that a conspicuous terms link on every page, with no other notice and no prompt to take an affirmative action showing assent, was not enough for constructive notice, and it said “the onus must be on website owners to put users on notice of the terms to which they wish to bind consumers.” That is one circuit ruling on its own facts: it says what was not enough, not what would be, so ask counsel before relying on any terms page.

6. Use hashes to notice changes

NIST SP 800-53’s integrity control, SI-7, lists cryptographic hashes among the mechanisms that can “automatically monitor the integrity of systems and hosted applications,” and an enhancement calls for cryptographic mechanisms “to detect unauthorized changes to software, firmware, and information.” A stored hash of the final exam form tells staff whether the file has been altered. It does not stop anyone from copying it; what hashes can show once a copy turns up elsewhere is in our article on content fingerprints.

7. Do not start watching members to catch a thief

The tempting response to a leak is to monitor everyone, and that creates its own problem. The NIST Privacy Framework, a voluntary tool, warns that a system can be “operating as intended” while its data processing leads to people “feeling surveilled,” and it calls such an activity a “problematic data action.” Fingerprinting appears nowhere in the Framework. Covertly recognizing members’ devices is one kind of processing that could leave people feeling that way, and our GPU fingerprinting article explains what those scripts can read.

8. Write the breach plan before anyone needs it

The FTC’s guide says you may need to notify those affected, and it adds: “In addition, many states and the federal bank regulatory agencies have laws or guidelines addressing data breaches. Consult your attorney.” NCSL’s summary, updated in January 2022, says every state, the District of Columbia, Guam, Puerto Rico and the Virgin Islands has a law requiring private businesses to notify people of breaches involving personally identifiable information, and that the laws differ on who must comply, what counts as personal information and what notice requires. As one example of those details, California’s Attorney General says any person or business required to notify more than 500 California residents of a single breach must electronically submit a sample copy of the notice, without personal information, to the Attorney General.

Two scope points belong in the plan’s first paragraph. The FTC guide is guidance written for businesses, not a rule. The Safeguards Rule states that it “applies to the handling of customer information by all financial institutions over which the Federal Trade Commission” has jurisdiction, and whether any such law reaches a given association is a question for its lawyer.

Checking the finished plan against the steps

A finished plan has the step 1 inventory with a reason on every row, a list of fields removed in step 2, a dated access review from step 3, a written split between secret and published material from step 4, and the name of the lawyer to call from step 8. If a row still reads “kept in case,” step 2 is not done.