Read the Case study below and answer the questions the follow:

Question

A glitch in big-four bank First national Bank's (FNB's) mobile app has exposed personal information of customers applying for home loans using the digital platform. It was discovered that if an FNB client used the mobile app to apply for a home loan, they would easily see the personal details of other home loan applicants. The exposed data includes personal identifiable information, such as names, identity numbers and contact details. An FNB client who discovered the exposed data has since informed the Information Regulator, asking it to take the necessary measures against the big-four bank.
"I wish to lodge a complaint against First National Bank in respect to a breach of personal information through their banking application," the client reported to the regulator.
"Whilst applying for a home loan through the service,
I noticed that I was able to access other individuals' personal information, such as ID numbers, contact details and various financial information, which is visible to other applicants, including my personal information.
"I have documented this by way of screenshots and have evidence to support this data breach.
I believe my rights in terms of the POPI Act [Protection of Personal Information Act] have been infringed and poses a huge personal security risk," stated the client.
"Your e-mail contents have been noted and will be addressed with the responsible party," says a complaints and investigations officer of the Information Regulator in an e-mail.Under South Africa's data privacy law, the Protection of Personal Information Act (POPIA), organisations must inform the Information Regulator if they expose the personal information of data subjects to unauthorised third parties without their approval. FNB has acknowledged exposing the personal information of its clients, saying it is in the process of notifying the relevant authorities, as well as those who have been impacted.
While the financial institution has rushed to disable the app functionality in question, it did not disclose how many customers were impacted.
Says the bank in a statement: "FNB is aware of a technical error that made the information of certain home loan applicants, such as full names and ID numbers, visible to other home loan applicants who logged in via our digital channels.
FNB takes the privacy and protection of customer information very seriously, and the affected functionality has since been temporarily disabled to resolve the root cause of the issue.
We are in the process of contacting the affected customers and the appropriate regulator.
Customers requiring any assistance can contact us through Secure Chat on the FNB app."
ENB recently made sweeping changes to its brand, including a redesign of its popular banking app.
The FNB app, introduced more than a decade ago, saw its active transacting base exceed 4.7 million customers, based on results for the year ended 30 June 2022.
The data exposure comes at a time the Information Regulator is receiving an unprecedented number of reports about data breaches in South Africa.
Speaking during the Governance, Risk and Compliance 2023 conference last week, advocate Pansy Tlakula, chairperson of the Information Regulator, revealed that data breaches are a big problem in this country - much bigger than people think. "Every public body, every private body that has suffered a security compromise or data breach has to notify us - there is no threshold. Even if one person was breached, they still have to notify us. If you look at 500 (it's 564 to be precise), it means that in a month, this country suffers about 56 data breaches - major and minor ones," she revealed. "I think we are one of the highest in the world with data breaches."
POPIA sets down firm frameworks that companies have to abide by to avoid fines, criminal persecution and potential reputation loss. Breaching the rules and regulations outlined by this Act can have serious financial implications for the business - repercussions that can cost a fortune and have long-lasting consequences, such as reputational damage.
The Act makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.POPIA sets down firm frameworks that companies have to abide by to avoid fines, criminal persecution and potential reputation loss. Breaching the rules and regulations outlined by this Act can have serious financial implications for the business - repercussions that can cost a fortune and have long-lasting consequences, such as reputational damage.
The Act makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.The Capability Maturity Model (CMM) is an additional benefit to organisations
that invest in information risk management programs.
Arrange each level of CMM for the FNB case study above to enjoy additional.Write an answer for 15 marks

Answer 1

To analyze the case study of the data breach involving First National Bank (FNB) using the Capability Maturity Model (CMM), we can arrange the levels as follows, highlighting what FNB can do to enhance its information security and compliance with the Protection of Personal Information Act (POPIA).

Capability Maturity Model Levels

1. Initial or Ad-hoc Level (Level 1 - Initial)

   • Description: Processes are unpredictable and poorly controlled. There are no formalized processes or standards in place for data protection.
   • Application to FNB: The incident indicates that FNB may have had inadequate controls over its digital platform, possibly reflecting an ad-hoc approach to information security regarding customer data. The breach suggests a lack of preventive measures that should be established to protect personal information.

2. Managed Level (Level 2 - Managed)

   • Description: The organization has established basic project management practices, and processes are planned and executed in accordance with policy.
   • Application to FNB: At this level, FNB should develop formal procedures for data management and protection to prevent unauthorized access to sensitive customer information. Implementing training programs for staff and users about data privacy protection could also be a step towards this maturity level.

3. Defined Level (Level 3 - Defined)

   • Description: The organization's processes are documented and standardized, which ensures consistency and repeatability.
   • Application to FNB: FNB could establish and document clear data protection policies, guidelines, and standard operating procedures that align with the requirements of POPIA. Regular audits and assessments of these procedures should also be established to ensure compliance and accountability.

4. Quantitatively Managed Level (Level 4 - Quantitatively Managed)

   • Description: The organization uses data and metrics to manage performance of processes and the quality of outputs.
   • Application to FNB: FNB should gather and analyze data regarding data breaches and incidents in order to improve their response strategies. This involves integrating performance metrics to monitor data security incidents and track the effectiveness of its data protection initiatives.

5. Optimizing Level (Level 5 - Optimizing)

   • Description: The organization focuses on continuous improvement and optimizes processes through innovative practices.
   • Application to FNB: At this highest maturity level, FNB can invest in advanced technology solutions, such as AI and machine learning, to enhance their data protection and security measures. This includes continuously updating their systems based on trends in security threats, fostering a culture of proactive information risk management and being compliant with evolving regulations.

Conclusion

To address the data exposure, FNB should move towards the higher levels of the Capability Maturity Model (CMM). This includes establishing a structured security framework, documentation of processes, data analytics for risk management, and leveraging technology for continuous improvement. By doing so, FNB not only ensures compliance with POPIA but also mitigates risks associated with data breaches, helping to maintain customer trust and safeguard its reputation.

---

This structured approach provides FNB with a clear pathway for improvement and aligns with the overarching goals of effective data governance and compliance in the financial services sector.