CCISO Legal and Regulatory 3

Question 1

Which international standard provides a framework for information security management systems (ISMS) and is most commonly cited in regulatory compliance contexts?

Accepted Answer

ISO 27001

Answer

ISO 27001 is the international standard specifying requirements for establishing, implementing, maintaining, and continually improving an ISMS.

Question 2

The Computer Fraud and Abuse Act (CFAA) primarily criminalizes which type of activity?

Accepted Answer

Unauthorized access to protected computers

Answer

The CFAA makes it a federal crime to access a protected computer without authorization or in excess of authorized access.

Question 3

Under GDPR, a data breach must be reported to the supervisory authority within what timeframe after the controller becomes aware of it?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it.

Question 4

Which US federal law established the framework for protecting critical infrastructure information shared between the private sector and the government?

Accepted Answer

CISA 2015

Answer

The Cybersecurity Information Sharing Act (CISA) of 2015 established protections and procedures for sharing cyber threat indicators between private entities and the federal government.

Question 5

A CISO must ensure compliance with PCI DSS. Which entity mandates PCI DSS compliance for organizations handling cardholder data?

Accepted Answer

Payment Card Industry Security Standards Council (PCI SSC)

Answer

The PCI SSC, founded by major card brands, develops and manages PCI DSS, which applies to all entities that store, process, or transmit cardholder data.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Legal and Regulatory 3