CAP Compliance & Regulatory Standards 4

Question 1

An organization must report a breach of unsecured PHI to HHS. If the breach affects 500 or more individuals, what is the notification deadline?

Accepted Answer

Within 60 days of discovery

Answer

HIPAA Breach Notification Rule requires covered entities to notify HHS of breaches affecting 500+ individuals within 60 calendar days of discovering the breach.

Question 2

Which NIST publication provides guidance specifically on security and privacy controls for federal information systems and organizations?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 is the primary catalog of security and privacy controls for federal information systems, organized into families and with multiple control baselines.

Question 3

The Children's Online Privacy Protection Act (COPPA) applies to websites collecting personal information from children under what age?

Accepted Answer

13

Answer

COPPA applies to operators of commercial websites and online services directed to children under 13, requiring parental consent before collecting personal information.

Question 4

A system security plan (SSP) is required under which regulatory mandate for federal agencies?

Accepted Answer

FISMA

Answer

FISMA requires federal agencies to develop and maintain an SSP that describes the security requirements of the system and the controls in place to meet those requirements.

Question 5

Under NIST SP 800-53 Rev 5, the Supply Chain Risk Management (SR) control family was introduced. Which control requires organizations to develop and implement a supply chain risk management plan?

Accepted Answer

SR-2

Answer

SR-2 (Supply Chain Risk Management Plan) requires organizations to develop, document, and disseminate a plan for managing supply chain risks to organizational systems.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Compliance & Regulatory Standards 4