Regulatory Requirements Flashcards

A federal civilian agency is authorizing a cloud-hosted system that processes data categorized as Moderate under FIPS 199. The CSP holds a FedRAMP Moderate authorization, but the agency's own risk assessment determines that several inherited controls do not adequately address agency-specific mission requirements. Under OMB Circular A-130 and the NIST RMF, what is the authorizing official's most appropriate course of action?

Answer: Reuse the FedRAMP authorization package as a baseline but require the agency to implement additional controls or compensating measures and issue its own authorization decision based on residual risk

FedRAMP promotes a 'do once, use many times' approach, but each agency AO remains accountable for accepting risk to its own operations and assets. The agency can leverage the FedRAMP package, tailor and supplement controls (e.g., customer-responsible controls or additional overlays), and must make its own risk-based authorization decision. Authorization decisions cannot be delegated to the CSP, and reassessing everything from scratch defeats reuse.

During a FISMA-driven continuous monitoring review, an agency discovers a system was authorized under an Authorization to Operate (ATO) with an ongoing, ongoing-authorization approach per NIST SP 800-37 Rev. 2. A significant change occurs: the system is migrated to a new hosting environment that alters the boundary and introduces new external interconnections. Which action is MOST consistent with regulatory and RMF expectations?

Answer: Conduct a security impact analysis, update the SSP and interconnection agreements, assess affected controls, and have the AO determine whether the change requires reauthorization or can be addressed within ongoing authorization

Under NIST SP 800-37 Rev. 2, ongoing authorization still requires change management: significant changes trigger a security impact analysis, updates to authorization documents (SSP, ISAs/MOUs), assessment of affected controls, and an AO determination of whether the risk remains acceptable or reauthorization is needed. Ongoing authorization does not waive assessment, nor does it automatically mandate shutdown.

A healthcare SaaS company supporting a federal agency must satisfy both HIPAA Security Rule requirements and NIST SP 800-53 controls. A business associate suffers a breach affecting 650 individuals in a single state. Which statement BEST describes the HIPAA Breach Notification Rule obligations?

Answer: Notify affected individuals within 60 days of discovery, notify HHS contemporaneously, and notify prominent media outlets in the state

For breaches affecting 500 or more individuals, covered entities must notify individuals without unreasonable delay and no later than 60 days after discovery, notify HHS contemporaneously (within the same 60-day window), and notify prominent media outlets if more than 500 residents of a state or jurisdiction are affected. Breaches under 500 are reported to HHS annually. Business associates must notify the covered entity, who then carries out these notifications (unless delegated by contract).

An organization processes payment card data and is also subject to Sarbanes-Oxley (SOX) Section 404. An internal audit finds that a system in scope for both has a segregation-of-duties conflict allowing a single administrator to modify financial reporting configurations and approve their own changes. How should the GRC practitioner BEST characterize the regulatory impact?

Answer: It is a deficiency potentially relevant to both: SOX ICFR through IT general controls over change management and access, and PCI DSS requirements on change control and separation of duties between environments and roles

SOX 404 management assessments of internal control over financial reporting commonly rely on IT general controls, including change management and logical access. PCI DSS also has change control procedures and role-based access/separation requirements. A self-approval conflict is a control deficiency under both frameworks, regardless of whether fraud has occurred; severity (deficiency, significant deficiency, material weakness) is evaluated for SOX.

Under the NIST RMF as applied through FISMA, which statement accurately describes the relationship between FIPS 199 impact categorization and the selection of a control baseline when a system processes multiple information types with differing impact levels?

Answer: The system's security category is determined by the highest impact value for each security objective (confidentiality, integrity, availability) across its information types, and the overall baseline follows the high-water mark

Per FIPS 199 and NIST SP 800-60, the security category of an information system is the highest (high-water mark) impact value for each security objective across all information types, and FIPS 200 baseline selection follows the overall high-water mark. Averaging or using minimums would under-protect higher-impact information.

A multinational organization transfers personal data of EU residents to a US-based processor for use in a federal-contractor information system. No adequacy decision covers the transfer, and the organization relies on Standard Contractual Clauses (SCCs). Which additional step is MOST aligned with the regulatory expectation following the Schrems II ruling?

Answer: Perform a transfer impact assessment evaluating the destination country's laws and practices and implement supplementary measures where necessary to ensure essentially equivalent protection

After Schrems II (CJEU C-311/18), exporters relying on SCCs must assess, case by case, whether the destination country's laws and practices undermine the SCCs' protections and adopt supplementary measures (technical, contractual, organizational) as necessary. SCCs are not automatically sufficient, a no-requests statement alone does not satisfy the assessment, and ISO 27001 certification is not a standalone transfer mechanism under GDPR Chapter V.