Privacy and Data Security Compliance Flashcards
6 cards from real CRCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Privacy and Data Security Compliance flashcards as text
Under the interagency guidelines for safeguarding customer information, financial institutions must conduct which activity to identify risks to customer data?
Answer: A risk assessment to identify reasonably foreseeable risks
The interagency guidelines require financial institutions to conduct a risk assessment to identify and evaluate internal and external risks to customer data security.
When a financial institution discovers a 'notification incident' involving customer data, current OCC/FDIC guidance requires notification to the primary federal regulator within:
Answer: 36 hours
The interagency computer-security incident notification rules require banks to notify their primary federal regulator within 36 hours of determining a notification incident occurred.
The Right to Financial Privacy Act (RFPA) restricts federal government agencies from obtaining customer financial records without:
Answer: Customer notice or legal process such as a subpoena
The RFPA requires federal government agencies to either notify the customer or use legal process (e.g., subpoena, court order) before obtaining financial records.
Under the GLBA Safeguards Rule, covered institutions must test or monitor the effectiveness of their security controls:
Answer: Regularly, as part of the information security program
The Safeguards Rule requires regular testing and monitoring of key controls and systems to ensure they are effective and up to date.
What is the purpose of a 'clean desk policy' in a bank's information security program?
Answer: To prevent unauthorized access to sensitive information left unattended in work areas
A clean desk policy requires employees to secure sensitive documents and data when leaving their workstations, reducing risk of unauthorized access.
Which privacy concept requires that personal data be used only for the purposes for which it was originally collected?
Answer: Purpose limitation
Purpose limitation is the principle that personal data should only be processed for the specific purposes disclosed at the time of collection.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- aba.com — Score validity, test delivery, fees, registration deadline, retake fee, retake policy, test dates, exam format, passing score, score release · verified Oct 2026