Compliance and Regulatory Requirements Flashcards

Which of the following BEST describes the role of a CISM in supporting a regulatory examination?

Answer: Coordinating the organization's response and ensuring requested evidence is complete and accurate

The CISM coordinates the examination response, ensuring examiners receive complete, accurate evidence while collaborating with legal, compliance, and business teams.

When a compliance requirement conflicts with a security best practice, a CISM should FIRST:

Answer: Analyze whether the compliance baseline is sufficient or whether compensating controls are needed

When compliance and best practice conflict, the CISM should analyze whether the compliance baseline provides adequate security or whether additional compensating controls are required.

Which of the following BEST describes the concept of 'privacy by design' in a compliance context?

Answer: Embedding privacy protections into systems and processes from the beginning of development

Privacy by design integrates data privacy protections into systems, processes, and products from inception, rather than adding them as afterthoughts.

A CISM discovers that a business unit is non-compliant with a key regulatory requirement. The MOST appropriate action is to:

Answer: Document the non-compliance, assess risk, and initiate a remediation plan with appropriate escalation

Non-compliance should be documented, risk-assessed, and addressed through a formal remediation plan with appropriate escalation to management.

Which of the following is a KEY benefit of integrating compliance and security program activities?

Answer: Duplication of effort is reduced and security controls serve multiple purposes simultaneously

Integrating compliance and security reduces duplication by using shared controls, frameworks, and assessments to meet both security and regulatory objectives efficiently.

Which of the following MOST accurately describes a 'compensating control' in a regulatory compliance context?

Answer: An alternative control implemented when the primary required control cannot be met

A compensating control is an alternative measure that provides equivalent protection when the specifically required control cannot be implemented due to technical or business constraints.