Risk Management and Compliance Flashcards

What is the primary difference between a vulnerability assessment and a penetration test?

Answer: A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact

A vulnerability assessment discovers and reports weaknesses, while a penetration test attempts to exploit them to validate actual risk and business impact.

Under HIPAA, what category of information must healthcare organizations protect?

Answer: Protected Health Information (PHI) that identifies individuals

HIPAA protects PHI — any individually identifiable health information held or transmitted by a covered entity or its business associates.

Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

Answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

What is a 'security control baseline' as used in NIST SP 800-53?

Answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

What does 'due diligence' mean in the context of cybersecurity governance?

Answer: Researching and understanding risks before implementing security controls and business decisions

Due diligence requires organizations to actively investigate and understand security risks, not merely assume that existing controls are sufficient.

Which regulation requires US public companies to maintain adequate internal controls over financial reporting and cybersecurity disclosures?

Answer: SOX (Sarbanes-Oxley Act)

SOX Section 404 requires management and auditors to assess internal controls, and the SEC now requires timely cybersecurity incident disclosure.