Regulatory Compliance & Legal Framework Flashcards

Under the Sarbanes-Oxley Act (SOX), which section specifically requires management to assess and report on internal controls over financial reporting?

Answer: Section 404

SOX Section 404 mandates that management assess and report on the effectiveness of internal controls over financial reporting annually.

Which U.S. federal regulation primarily governs business continuity requirements for federally insured depository institutions?

Answer: FFIEC Business Continuity Planning Booklet

The FFIEC Business Continuity Planning Booklet provides supervisory guidance specifically for federally insured depository institutions' BC programs.

A company discovers that a contractual obligation conflicts with a new state privacy law. What is the FIRST step the BC manager should take?

Answer: Escalate to legal counsel for guidance on compliance hierarchy

Legal counsel must determine which obligation takes precedence and advise on remediation steps before any action is taken.

The EU's Network and Information Security (NIS2) Directive requires entities to report significant incidents within how many hours of detection?

Answer: 24 hours

NIS2 requires an early warning notification to the relevant authority within 24 hours of becoming aware of a significant incident.

Which legal concept holds a parent company responsible for the BC failures of its subsidiaries when those failures cause third-party harm?

Answer: Vicarious liability

Vicarious liability can make a parent company legally responsible for the acts or omissions of entities under its control.

Under HIPAA, a covered entity must report a breach affecting 500 or more individuals to which authority within 60 days?

Answer: HHS Office for Civil Rights

HIPAA's Breach Notification Rule requires covered entities to notify HHS Office for Civil Rights within 60 days of discovering a breach affecting 500+ individuals.

Which standard specifically addresses supply chain risk management within an information security framework and is relevant to BC compliance?

Answer: ISO/IEC 27036

ISO/IEC 27036 provides guidelines for information security in supplier relationships, directly addressing supply chain risk relevant to BC compliance.