Compliance and Regulatory Requirements Flashcards
6 cards from real CISM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Compliance and Regulatory Requirements flashcards as text
A CISM discovers that a new business initiative will require processing of EU citizen data. Which regulation MUST be considered?
Answer: GDPR
The General Data Protection Regulation (GDPR) applies to any organization processing personal data of EU residents, regardless of where the organization is located.
Which of the following is the PRIMARY purpose of a compliance audit?
Answer: To assess whether the organization's controls meet applicable requirements
A compliance audit evaluates whether an organization's controls, processes, and practices meet the requirements of applicable laws, regulations, or standards.
A CISM is informed that regulatory requirements in the organization's industry have changed. The MOST appropriate response is to:
Answer: Immediately conduct a gap analysis to identify required changes to controls and processes
A prompt gap analysis identifies what the new requirements demand and where current controls fall short, enabling timely and prioritized remediation.
Which of the following BEST describes a 'control deficiency' in a compliance context?
Answer: A failure of a control to operate as intended or meet a required standard
A control deficiency is a gap where a control either doesn't exist, fails to operate as designed, or fails to meet the required standard.
The Federal Information Security Modernization Act (FISMA) PRIMARILY applies to:
Answer: US federal agencies and contractors that handle federal information
FISMA applies to US federal agencies and contractors that handle federal information, requiring them to develop, document, and implement information security programs.
A CISM is tasked with reducing compliance costs while maintaining all required standards. The BEST approach is to:
Answer: Implement a common controls framework to satisfy multiple requirements simultaneously
A common controls framework identifies controls that satisfy multiple regulatory requirements simultaneously, reducing redundancy and overall compliance costs.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- isaca.org — Renewal, test delivery, eligibility, score validity, fees, exam format, passing score, retake fee, score release, test dates · verified Oct 2026