Cache-22: Doing Privacy Engineering with Privacy Standards
summary
Fourteen hourlong interviews reveal that privacy engineers split between compliance as baseline (GDPR, COPPA) and occasional use of frameworks (NIST, ISO, FedRAMP/C5) where seniority and budget allow. Teams commonly extract controls piecemeal rather than pursue full certification, trading auditable standards for in‑house mixes. Core operational roles include a translator role between legal and engineering; recurring obstacles are limited budget, organizational culture, cross‑jurisdiction legal complexity, vendor opacity, and poor data governance. Findings quantify prevalence and practical tooling gaps rather than propose new theory.
AI-written summary · about
chapters (7)
- 0:00Cache-22 and research focus
- 3:18Methodology and interviewees
- 6:07Compliance overshadowing standards
- 8:55Privacy standards in practice
- 11:23Privacy engineers as translators
- 12:48Key challenges
- 15:11Takeaways and future research
related talks
12mPrivacy Engineers on the Front Line: Bridging Technical and Managerial Skills
40mCreative Ways to Champion Privacy Engineering Awareness
01h 15mDATA PROTECTION ENGINEERING: WHAT IS THE ROAD AHEAD?
37mDelivering High Speed with Low Risk
37mFrom the Trenches Privacy Engineering Pitfalls Successes
49mHow to Kick Off Privacy Engineering Within a Security Team
40mExtreme Makeover: Privacy Edition
50mPrivacy Standards in the Context of Information Security