How to use assessments for GDPR compliance

Posted by John Kleeman

In about a year’s time, on 25 May 2018, a major new European law, the GDPR, comes into effect. It will update current laws and set new requirements for handling personal data. The GDPR will replace country-specific current data protection laws and will impact any organization anywhere in the world that stores or manages data about people who live or work in Europe. With implementation of the GDPR just a year away, organisations need to prepare themselves now to implement it.

This post explains how an online assessment management system like Questionmark can help your organization comply with the GDPR. We also invite you to a free webinar where you can learn more about how assessments can help you comply.

What will be the fines for failing to comply with the GDPR?

European regulators are suggesting that those who don’t comply will face large fines. The law itself says that fines can be up to €20 million or 4 percent of turnover (whichever is more). The Irish data commissioner has said that there will be no leeway or grace period, and that noncompliant firms will be heavily fined — this under a data protection regime generally considered to be more business-friendly than those in some other countries. Some European regulators are also preparing the ground by issuing high fines under existing data protection regulations. For example, the Italian Data Protection Authority has just issued an €11 million fine.

What is the learning challenge for GDPR?

The GDPR has specific requirements for training personnel and for monitoring the effectiveness of the training. In addition, most companies will be incentivized to train their employees to ensure that personnel understand the GDPR and their own company policies/procedures – since failing to follow the rules will make companies liable for fines.

The GDPR legislation is 88 pages long and the rules are complex. Within most companies, many different departments will be responsible for handling and processing data: HR, IT, sales and marketing, technology and product development and more. All these departments will need to climb the learning curve to know and understand how the GDPR applies to them.

Thus, a key part of the compliance challenge for GDPR will be ensuring that your personnel learn and understand the rules.

How assessments can help

An assessment management system like Questionmark’s lets you:

  • Create quizzes, tests and exams on the GDPR’s or your company’s policies and procedures
  • Deliver them to personnel at home, work or on mobile devices
  • Analyze the results to help you find weaknesses or potential problems
  • Store the results as trustable evidence that your people understand

Trustable, online assessments can help in many ways with GDPR compliance.  They are the best way to help ensure your employees understand the rules and to reduce the likelihood of mistakes that lead to fines. Assessments are also the best way of providing evidence that you did train your personnel well. This evidence could mitigate the amount of a fine, in the event of a privacy misstep.

Questionmark’s webinar

To help you understand more about how online assessments can help you meet your GDPR challenge, we invite you to a webinar presented by myself and Questionmark’s UK Marketing Manager, Chloe Mendonca on Thursday 29th June, 2017.

The webinar will cover:

  • What the GDPR is and who it impacts
  • Why you should care about GDPR compliance
  • How to overcome the challenges presented by GDPR — including the learning curve for your employees
  • How assessment can help mitigate GDPR risks and aid your compliance strategy
  • Considerations for implementing assessment management software to aid in compliance

We look forward to speaking to you at the webinar. Click here to register.

GDPR Webinar Image

 

The Power of Open: Questionmark’s open assessment platform

Posted by Steve Lay

In the beginning there was CVS, then there was SVN and now there’s Git.  What am I talking about?  These are all source code control systems, systems that are used to store computer source code in a way that preserves the complete version history and provides a full audit trail covering the who, what, when and why changes were made.

When we think of open source software we tend to think of the end product: a freely downloadable program that you can run on your computer or even a complete computer operating system in the case of Linux.  But to open source developers, open source is about more than this ‘free beer’ model of sharing software.  Open source software is shared at the source code level allowing people to examine the way it works, suggest changes to fix bugs, enhance it or even to modify it for their own purposes.  Getting the most from sharing source code requires more than just sharing an executable or a zip file of the finished product, open source developers need to open up their source code control systems too.

For years there have been services that provide a cloud-based alternative to  hosting your own source code.  The SourceForge system enjoyed many years of dominance but more recently it’s advertising sponsored model has seen it fall out of favour.

Most new projects are now created on a service called GitHub, which promises  free hosting of open source projects on a service funded by paying customers who are developing projects privately on the same platform.  The success of GitHub has been phenomenal – Google closed down its own rival service (Google Code) largely because of GitHub’s success.  In fact, GitHub is rapidly becoming a ‘unicorn’ with all the associated growing pains.  GitHub makes it easy to collaborate on projects too with its issue tracking system and user friendly tools for proposing changes (known as ‘pull requests’).

With GitHub as the de facto place to publish and share source code, it makes sense for Questionmark to use it to complement our Open Assessment Platform.  We have published source code illustrating how to use our APIs for many years and even publish the complete source to some of our connectors.  Putting new projects on GitHub means providing sample code in the most transparent and developer-friendly way possible.

Questionmark’s GitHub page lists all the projects we own.  For example, when we first brought out our OData APIs we published the sample reportlet code in the OData Reportlet Samples project.  You can experiment with these same examples running live in our website’s developer pages.

Recently we’ve gone a step further in opening up our assessment platform.  We’ve started publishing our API documentation via GitHub too!  Using a new feature of the GitHub platform we’re able to publish the documentation directly from the source control system itself.  That means you always get access to the latest documentation.

Opening up our API documentation in this way makes it easier for developers to engage with our platform.  Why not check out the documentation project.  If you’re already a GitHub user you could ‘watch’ it to get notified when we make changes.  You can even submit issues or send us ‘pull requests’ if you have suggestions for improvement.

With GitHub as the de facto place to publish and share source code, it makes sense for Questionmark to use it to complement our Open Assessment Platform.  We have published source code illustrating how to use our APIs for many years and even publish the complete source to some of our connectors.  Publishing this source code helps our customers and partners by providing working examples of how to integrate with our platform as well as providing complete transparency for our connectors allowing customers to audit the code before they run it on their own systems.  Putting new projects on GitHub means providing sample code in the most transparent and developer-friendly way possible.

How online assessments (quizzes, tests and exams) can help information security awareness and compliance

Posted by John Kleeman

With the rise of data security leakages, most professional organizations are seeking to significantly upscale their cybersecurity to better protect their organization from information security risks. I see an increasing use of online assessments helping information security and thought I’d provide some pointers about this.

There are three main ways in which online quizzes, tests, exams and surveys can aid information security:

  • Testing personnel to check understanding of security awareness and security policies
  • Ensuring and documenting that personnel in security roles are competent
  • Helping measure success against security objectivesNIST logo

Testing on security awareness and knowledge of policies

A cornerstone of good practice in security is training in security awareness. For example, the widely respected NIST 800-53 publication recommends that organizations provide general-purpose and role-based training to personnel as part of initial training and periodically thereafter. If you follow NIST standards, NIST control AT-4 also requires that all security training be documented and records retained.

There is widespread evidence that delivering an assessment is the best way of documenting that training took place, because it doesn’t just document attendance but also understanding of the training. For more explanation, see the Questionmark blog post Proving compliance – not just attendance. The only point of security awareness training is to have the training be understood, so testing to confirm understanding is widespread and sensible.

At Questionmark, we practice what we preach! All our employees have to take a test on data security when they join to check they understand our policies; all employees must also take and pass an updated test each year to ensure they continue to understand.

Ensure that people in security roles are competent

iso 27001The international security standard ISO 27001:2013 requires that an organization determine the necessary competence of personnel affecting information security performance. The organization must also ensures that personnel have such competence and retain evidence of this.

In a large organization with many different security roles, developing and using competence tests for each information security-related role is a good way of measuring and showing competence.  Knowing who is competent in which aspect of security and data protection matters: it ensures that  you are covering appropriate risks with appropriate people. Online testing is an effective way of measuring competence and makes it easy to update competence records by giving periodic tests every six months or annually.

Helping measure information security objectives

PCI logoISO 27001 also requires setting up metrics to measure information security objectives. Results from assessments can be a good metric to use.  Other standards say similar things. For example, the PCI standard widely used for credit card security says in its best practice guide:

“Metrics can be an effective tool to measure the success of a security awareness program, and can also provide valuable information to keep the security awareness program up-to-date and effective”

The PCI guide recognizes that good metrics include “feedback from personnel; quizzes and training assessments”. In my experience, as well as using quizzes and tests to measure knowledge, it also makes sense to use online surveys to assess actual practice by employees and to allow reporting of security concerns.

Testing on information security and data protection is an increasing use case for Questionmark’s trustable SaaS assessment management system, Questionmark OnDemand.  Whichever security standard you are following (ISO 27001, NIST, PCI or one of several others), creating online assessments tailored to measure knowledge of your organization’s policies and procedures using an assessment management system like Questionmark’s can make a useful difference.

Why a “good enough” assessment solution will do more harm than good

Posted by Chloe Mendonca

Regardless of the size of a department or organization, we’re all keen to improve efficiency and when it comes to assessments — improve validity and reliability. Selecting the right assessment tool is critical. Sticking with a “good enough” solution will do more harm than good. In the short term it will hinder your productivity; in the long run it could not only mean a painful migration from one system to another, but could also cost you a fortune in compliance fines or HR disputes!

“Good enough” assessment solutions are usually fine for creating basic surveys and quizzes, but when you use assessment results to make defensible decisions about people, you need a more complete solution. So how do you distinguish a “good enough” assessment solution from a complete one?

Choosing a complete solution

As you go through the selection process, consider whether simplicity comes at the expense of security or robust functionality.We know it can be confusing to sort through the extensive number of options. And we know every company has different assessment needs. If you need to weigh up your options, this cheat sheet will highlight the limitations of a “good enough” assessment tool and explain how a complete solution will help make your job easier and your assessments more valid and reliable.

Complete assessment management platforms are designed with security, validity and reliability in mind

The cheat sheet also discusses how complete assessment management technologies trump “good enough” solutions in several areas, including:

  • Establishing content validity
  • Managing multilingual assessments
  • Maintaining an audit trail
  • Developing observational assessments
  • Minimizing cheating and content theft

It’s worth spending a good amount of time fully evaluating your options and choosing a solution that can scale with your organization. Interested in learning more about how to evaluate a complete assessment solution? Download this cheat sheet, “Are you settling for a “good enough” assessment solution?”

Questionmark Conference 2017: Three hot topics from Santa Fe

Bart Hendrickx SmallPosted by Bart Hendrickx

There was a lot to learn at the Questionmark Conference 2017, as my colleagues Chloe Mendonça and John Kleeman alluded to in their blog posts Reminiscing about Santa Fe and Assessment good practice: 6 tips from Santa Fe. I had the privilege to present several sessions and interact with a lot of customers. Here are the key things I took away from the conference:

People want to brand assessment delivery screens

This is not new: we have been supporting the branding and customization of assessment delivery screens for many years. The new Questionmark OnDemand Portal also offers various options  for branding the user experience, including for admin users – a new development compared to the classic Portal. However, most people are especially interested in customizing the way assessments are delivered to participants.

Roles and permissions can be a little daunting

The new Questionmark Portal offers many capabilities relating to roles and permissions. Refer to these blog posts from last year to get an idea: Role-based permissions: A how-to guide part 1 and part 2. While people appreciate the power of Questionmark OnDemand’s roles and permission management, they also understand that sometimes it requires a specific combination of permissions to get a role “just right”. We received several suggestions from customers on how to make this part of the software more welcoming to new users.

Integrations with Learning Management Systems remain important

Again, not something new but it was interesting to experience just how important LMS integrations are for our users. Questionmark has been supporting several integration standards for a long time. We have also enhanced the ubiquitous SCORM integrations by making it possible to include SAML in the workflow. This enables customers to combine SCORM’s launch and track capabilities with SAML’s security and demographic mapping, resulting in more secure assessment delivery and additional participant demographics that can be used in reports.

I would like to thank everyone who shared such useful feedback with us.

Want to enhance exam integrity? Need to ensure compliance? Then don’t miss these webinars!

Posted by Chloe Mendonca

Proxy testing … Cheating …. Content theft. Does the battle ever end? The techniques and technologies being used to compromise the integrity of your test programs are complex and continually evolving. Many organisations are increasingly turning to online proctoring solutions.

Research shows that when properly applied, online proctoring can be as or more effective than traditional test centre proctoring. Besides reducing security risks, it provides test takers the convenience of taking tests from their homes, workplaces or colleges. It also reduces costs not only for administrators but also for test takers. Consider for a moment the testing fees, travel, parking, and the simple time away from work or studies.  In addition to online proctoring’s effectiveness one of the most exciting things is that this approach has the potential to grow as technology becomes more advanced and widespread.

Before implementing online proctoring, organisations should approach with caution, not all online proctoring services are equivalent. While some are designed with high-stakes tests in mind others can actually increase the risk of cheating. So what do you need to consider? What should you be wary of? Is online proctoring suited to your organisation or institution? Join Questionmark for a 45-minute webinar answering these questions and more.

Register for: Enhancing Exam Integrity with Online Proctoring

Online Proctoring is only a small part of achieving exam integrity. For those less familiar with Questionmark’s end-to-end Assessment Management System, find out how security is embedded at every stage of assessment development in our 60-minute demo. Discover the features and functions available to help you securely create, deliver and report on your surveys, quizzes, tests and exams in our introductory webinar. Note, we are also holding this webinar in Dutch.

Register for: An Introduction to Questionmark’s Assessment Management System

Or for organisations working in sectors that demand compliance, learn about 7 ways that assessments can enhance your eLearning and compliance strategy and best practices for using them in our 30-minute German webinar.

Register for: Warum und wie Sie Compliance-Prüfungen nutzen sollten

 

« Previous PageNext Page »