CAP Compliance & Regulatory Standards 2

Question 1

Which federal law requires agencies to report major information security incidents to Congress and OMB within a specific timeframe?

Accepted Answer

FISMA

Answer

FISMA requires federal agencies to report major incidents to Congress and OMB, establishing accountability for information security.

Question 2

Under NIST SP 800-53, which control family specifically addresses audit and accountability requirements?

Accepted Answer

Audit and Accountability (AU)

Answer

The AU (Audit and Accountability) control family in NIST SP 800-53 covers audit log generation, review, and retention requirements.

Question 3

Which Privacy Act requirement mandates that agencies publish notice of their records systems in the Federal Register?

Accepted Answer

System of Records Notice (SORN)

Answer

A System of Records Notice (SORN) must be published in the Federal Register before an agency can create or modify a system that retrieves records by personal identifier.

Question 4

A healthcare organization subject to HIPAA must conduct a risk analysis under which specific rule?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule requires covered entities to conduct a thorough assessment of the potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability.

Question 5

Under FedRAMP, what is the minimum assessment frequency for systems with a Moderate impact level?

Accepted Answer

Continuous monitoring with annual authorization review

Answer

FedRAMP Moderate systems require continuous monitoring with an annual authorization review to maintain an Authorization to Operate (ATO).

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Compliance & Regulatory Standards 2