Risk Management and Compliance Flashcards

In risk management, what does the formula Risk = Threat × Vulnerability × Impact represent?

Answer: A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact

This formula helps prioritize risks by combining the likelihood of a threat exploiting a vulnerability with the potential business impact.

Which risk treatment option involves purchasing cyber insurance to offset potential financial losses?

Answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider, without eliminating the risk itself.

What US federal law requires federal agencies to implement a risk management framework for information security?

Answer: FISMA (Federal Information Security Modernization Act)

FISMA requires federal agencies and contractors to develop, document, and implement information security programs based on NIST frameworks.

In the NIST Risk Management Framework (RMF), what is the correct order of the first three steps?

Answer: Prepare, Categorize, Select

NIST RMF steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor — Prepare was added in RMF Rev 2.

Which compliance framework applies specifically to organizations that process, store, or transmit payment card data?

Answer: PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) is mandated by card brands for any entity handling cardholder data.

A CNDA is performing a Business Impact Analysis (BIA). What are the two primary metrics gathered for each critical system?

Answer: RTO (Recovery Time Objective) and RPO (Recovery Point Objective)

RTO defines how quickly a system must be restored after failure, while RPO defines the maximum acceptable data loss measured in time.