| Course | ACC-6070 Accounting and Information Systems Design and Implementation |
|---|---|
| Module | Module 5 |
| Paper type | Module 5 written assignment: information privacy and availability controls |
| Length | About 723 words, 5 pages |
| Format | APA 7 student paper |
| School | Thomas Edison State University |
| Program | Master of Science in Accounting |
| Updated | October 2026 |
Free sample paper for ACC 6070 Module 5
Protecting Customers and Keeping the Store Open: Privacy, Integrity and Availability Controls for an Online Retailer
Student Name
Master of Science in Accounting, Thomas Edison State University
ACC-6070: Accounting and Information Systems Design and Implementation
Mentor Name
Month Day, Year
Protecting Customers and Keeping the Store Open: Privacy, Integrity and Availability Controls for an Online Retailer
Introduction
Romney and Steinbart (2018) organize systems reliability around security and four further principles: confidentiality, privacy, processing integrity and availability. Confidentiality protects an organization's sensitive information, such as plans and pricing. Privacy protects personal information about customers and employees, and is governed by what the organization has promised and what law requires. Processing integrity ensures that data is processed accurately, completely and with authorization, and availability ensures that systems are there when needed.
Part A: Confidential Versus Private Information
The controls overlap, encryption and access limits apply to both, but privacy adds obligations confidentiality does not: giving notice, obtaining consent, letting people see and correct their data and disposing of it when no longer needed.
| Information | Category | Why it matters |
|---|---|---|
| Supplier cost terms and margin targets | Confidential | Competitors could undercut prices |
| Product launch calendar | Confidential | Loss of first-mover advantage |
| Customer names, addresses and order history | Private | Promised protection in the privacy notice |
| Stored payment tokens | Private and subject to card industry rules | Fraud and fines if exposed |
| Employee Social Security numbers | Private | Identity theft and state breach laws |
Part B: Scoring Practices Against the Privacy Principles
The generally accepted privacy principles, developed by the AICPA and CICA (2009) and since succeeded by the AICPA's Privacy Management Framework, set ten areas. Hearth and Harbor's review found the following.
Privacy failures cost trust as well as fines. Culnan and Armstrong (1999) found that customers were more willing to allow their information to be used when firms explained their practices and treated them fairly, which makes clear notice and access a commercial asset as well as an obligation.
| Principle | Current practice | Gap and fix |
|---|---|---|
| Management | No one owns privacy | Name a privacy officer reporting to the CFO |
| Notice | Notice posted but last updated in 2019 | Update to describe analytics and advertising partners |
| Choice and consent | Marketing email is opt-out | Make tracking for advertising opt-in where state law requires |
| Collection | Birth dates collected for no clear purpose | Stop collecting them |
| Use, retention and disposal | Order data kept forever | Set a seven-year retention schedule and purge older records |
| Access | Customers cannot download their data | Add a download and correction request process |
| Disclosure to third parties | Data shared with a marketing firm without contract terms | Add privacy terms and audit rights |
| Security for privacy | Customer database encrypted at rest | Adequate |
| Quality | Duplicate accounts common | Merge duplicates on email address |
| Monitoring and enforcement | No complaint log | Track and review privacy complaints quarterly |
Part C: Encryption, Hashing and Digital Signatures
Symmetric encryption uses one key to encrypt and decrypt and is fast, so the company uses it to encrypt the customer database at rest. Asymmetric encryption uses a public key to encrypt and a private key to decrypt; the website's TLS certificate uses it to exchange a session key with each browser, after which the session is encrypted symmetrically. Hashing produces a fixed-length digest that cannot be reversed; passwords are stored as salted hashes, so a stolen database does not reveal them. A digital signature is a hash of a document encrypted with the sender's private key. When the company sends a payment file to its bank, the signature lets the bank confirm that the file came from Hearth and Harbor and was not altered, which would have defeated the altered-bank-account fraud common in supplier payments.
Part D: Processing Integrity and Availability
Processing integrity controls follow the data. At input, the checkout page validates field formats, addresses and card numbers with a check digit test; in processing, batch totals reconcile orders captured with orders posted to the ledger; at output, daily reports of orders, refunds and inventory are reviewed and exceptions investigated.
For availability, the company sets a recovery time objective of four hours for the storefront, the longest outage it can tolerate, and a recovery point objective of 15 minutes, the most data it can lose. Meeting these requires continuous database replication to a second cloud region, nightly full backups stored separately and immutably to resist ransomware, and a tested disaster recovery plan rehearsed twice a year, including before the holiday season.
Processing integrity and availability support each other: replicated data is useful only if it is accurate, and accurate data is of little value if the store is down during the holiday rush.
References
AICPA & CICA. (2009). Generally accepted privacy principles. American Institute of Certified Public Accountants.
Culnan, M. J., & Armstrong, P. K. (1999). Information privacy concerns, procedural fairness, and impersonal trust: An empirical investigation. Organization Science, 10(1), 104-115. https://doi.org/10.1287/orsc.10.1.104
Romney, M. B., & Steinbart, P. J. (2018). Accounting information systems (14th ed.). Pearson.
What the ACC 6070 Module 5 instructions ask for
The fifth module's assignment moves past security to the other reliability principles. Expect questions that distinguish confidentiality from privacy, apply the generally accepted privacy principles, explain symmetric and asymmetric encryption, hashing, digital signatures and certificates, and describe controls for processing integrity and for availability, such as backups, recovery objectives and disaster recovery plans. Prompts may give a company or ask you to evaluate your own employer. Expect questions that ask how a company would meet each principle in practice and what it would cost. Some versions add a question on processing integrity controls for a specific application, such as online checkout.
How the ACC 6070 Module 5 example is put together
The introduction sets out the reliability principles the module covers. Part A classifies the retailer's information as confidential or private and explains what privacy adds. Part B scores practices against all ten privacy principles in one table with fixes, supported by research on privacy and customer trust. Part C explains encryption, hashing and digital signatures through the retailer's own uses. Part D gives input, processing and output controls for integrity and sets recovery objectives with the measures needed to meet them. Each concept is explained through the retailer's own data and systems, which keeps the paper applied throughout, and the recovery objectives are set from the business's tolerance for outage and data loss.
Where the marks sit in the ACC 6070 Module 5 rubric
Privacy and availability answers carry 7 points toward the final grade. Mentors check that confidentiality and privacy are distinguished correctly, that the privacy principles are applied rather than listed, that encryption concepts are explained accurately and that integrity and availability controls fit the risks. Setting recovery targets and saying how they will be met, with research support, shows applied understanding. Organization and APA form count for the final share of the points. A privacy review that assesses every principle against current practice, with a specific fix for each gap, shows the depth mentors want. Recovery objectives with the measures needed to achieve them complete a strong answer. Every principle should be addressed. Showing how the privacy fixes would be monitored over time completes the review.
ACC 6070 Module 5 help from the desk
Privacy assignments often lose points by treating privacy and confidentiality as the same thing, listing the principles without assessing practice and confusing hashing with encryption. Classify each type of information first. Assess each principle against what the organization actually does. Explain encryption through a specific use. Classify each piece of information before choosing controls, and use one consistent example to explain encryption, hashing and signatures so the differences are clear. State the recovery time and recovery point objectives in hours or minutes. Tag every recommended control by type. A free first sample of your own ACC-6070 Module 5 assignment is available on request.
Write yours, or have the desk draft it
This paper is an original model document written by our desk, not a submitted student paper and not an official Thomas Edison State University document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.
More ACC 6070 and Master of Science in Accounting sample papers
- ACC 6070 Module 1: Written Assignment: The Strategic Role of the AIS
- ACC 6070 Module 2: Written Assignment: Database Design and Documentation
- ACC 6070 Module 3: Written Assignment: Fraud and Computer Crime
- ACC 6070 Module 4: Midterm Project: The COBIT Framework, Its Challenges and Sustainability
- ACC 6070 Module 6: Final Project: Data Analytics and E-Commerce in Business Decisions
- ACC 5010 Module 5: Short Paper: Luckin Coffee's Fabricated Sales
- IBF 5030 Module 6: Final Project: Presenting the Statements, U.S. GAAP Against IFRS
- ACC 6040 Module 3: Written Assignment: Adjusting, Closing and Communicating Results
- ACC 5070 Module 1: Written Assignment: Sorting a Township Into Funds
ACC 6070 Module 5 questions, answered
Where can I find a free ACC 6070 Module 5 sample paper?
The online retailer privacy and availability assignment appears above: confidential versus private data, a privacy principles review, encryption and signatures, and integrity and recovery controls.
What is the difference between confidentiality and privacy?
Confidentiality protects an organization's sensitive business information; privacy protects personal information about individuals under notice, consent and legal duties.
How is hashing different from encryption?
Encryption can be reversed with a key; hashing produces a fixed digest that cannot be reversed, used for passwords and integrity checks.
What does a digital signature prove?
That a document came from the holder of the private key and was not changed after it was signed.
What are recovery time and recovery point objectives?
Recovery time is how long a system may be down; recovery point is how much recent data, counted in minutes or hours, the business can lose.