CCISO Legal and Regulatory 4

Question 1

A CISO must understand the concept of 'safe harbor' in data privacy law. In the context of GDPR, which mechanism serves as a safe harbor for transferring personal data to the US?

Accepted Answer

Standard Contractual Clauses (SCCs)

Answer

Following the invalidation of Privacy Shield by Schrems II, Standard Contractual Clauses (SCCs) are the primary mechanism for lawful EU-to-US personal data transfers.

Question 2

Which legal concept holds that an organization can be held liable for damages caused by third-party vendors who handle their customers' data?

Accepted Answer

Vicarious liability

Answer

Vicarious liability can hold an organization responsible for the actions or negligence of third parties acting on its behalf, including data processors and vendors.

Question 3

Under FISMA (Federal Information Security Management Act), federal agencies must categorize information systems using which framework?

Accepted Answer

FIPS 199

Answer

FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems) provides the framework for categorizing systems as low, moderate, or high impact.

Question 4

A CISO at a healthcare organization learns of a breach affecting 600 unsecured PHI records. Under HIPAA Breach Notification Rule, what notification is required within 60 days of the end of the calendar year?

Accepted Answer

Annual summary to HHS only

Answer

For breaches affecting fewer than 500 individuals, HIPAA requires covered entities to notify HHS annually within 60 days of the end of each calendar year.

Question 5

The Electronic Communications Privacy Act (ECPA) restricts government access to electronic communications. Which part of ECPA specifically governs stored communications and data at rest?

Accepted Answer

Title II – Stored Communications Act

Answer

Title II of ECPA, known as the Stored Communications Act (SCA), governs government access to stored electronic communications and subscriber data held by third-party providers.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Legal and Regulatory 4