Data Management and Privacy Controls Flashcards

Which US regulation primarily governs the privacy and security of health information held by covered entities and their business associates?

Answer: HIPAA (Health Insurance Portability and Accountability Act)

HIPAA's Privacy and Security Rules set standards for protecting individually identifiable health information (PHI) in the US.

An IS auditor reviewing data backup controls should PRIMARILY verify that:

Answer: Backups are tested regularly to confirm successful restoration

An untested backup provides no guarantee of recovery; regular restoration tests confirm data integrity and process reliability.

Which of the following is the PRIMARY control to ensure data integrity in a database?

Answer: Implementing referential integrity constraints and input validation

Referential integrity constraints and input validation prevent invalid data from entering the database and maintain consistency between related tables.

A data owner is BEST described as:

Answer: The business executive accountable for the data and its appropriate use

The data owner is a business-side role accountable for defining data classification, access requirements, and appropriate use policies.

Which of the following BEST describes the purpose of a data loss prevention (DLP) solution?

Answer: To detect and prevent unauthorized transmission of sensitive data outside the organization

DLP tools inspect content in motion, at rest, and in use to identify and block unauthorized exfiltration of sensitive information.

During an audit of cloud data storage, an IS auditor should PRIMARILY confirm that:

Answer: Data encryption, access controls, and contract-defined data handling terms are in place

Encryption, access controls, and contractual data handling obligations are the core security requirements for cloud-stored data.