Compliance and Regulatory Requirements Flashcards

Which US federal law PRIMARILY governs the protection of personal health information in the healthcare industry?

Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA establishes federal standards for protecting the privacy and security of individually identifiable health information in the US healthcare industry.

A CISM is developing a compliance program. The FIRST step should be to:

Answer: Identify all applicable laws, regulations, and contractual obligations

Identifying all applicable regulatory, legal, and contractual requirements is the foundational step before any compliance program activities can be structured.

Under the Sarbanes-Oxley Act (SOX), which of the following is a KEY information security requirement?

Answer: Internal controls over financial reporting, including IT general controls

SOX requires organizations to establish and maintain internal controls over financial reporting, which includes IT general controls that protect the integrity of financial systems.

Which of the following is MOST important when mapping security controls to regulatory requirements?

Answer: Using a unified control framework to address multiple requirements efficiently

A unified control framework maps controls to multiple regulations simultaneously, reducing duplication and improving efficiency across compliance programs.

Which of the following BEST describes the difference between a regulation and a standard in the context of compliance?

Answer: Regulations are legally mandated by governments; standards are typically voluntary industry guidelines

Regulations are legally enforceable requirements imposed by government authorities, while standards are generally voluntary guidelines developed by industry bodies.

The Payment Card Industry Data Security Standard (PCI DSS) applies to organizations that:

Answer: Store, process, or transmit cardholder data

PCI DSS applies to any organization that stores, processes, or transmits payment card data, regardless of industry or size.