Regulatory Requirements Flashcards

A federal agency's system is categorized Moderate under FIPS 199 and processes Privacy Act records. During the RMF Select step, the ISSO tailors the NIST SP 800-53 Rev. 5 Moderate baseline by removing a control that the system cannot technically implement. Which action is MOST consistent with the tailoring requirements of NIST SP 800-53 and SP 800-37?

Answer: Apply a compensating control or alternative implementation, document the rationale and risk acceptance in the security plan, and obtain Authorizing Official concurrence

Tailoring permits scoping, compensating controls, and parameter selection, but any deviation from the baseline must be justified and documented in the security plan, with the risk accepted by the Authorizing Official. Controls cannot be silently removed, and lowering the categorization to avoid a control is improper because categorization must reflect actual impact, including privacy-related impacts.

A cloud service provider holds a FedRAMP Moderate authorization. An agency wants to leverage it for a system whose data would require a High impact baseline under FIPS 199. What is the correct regulatory position?

Answer: The Moderate authorization does not cover the High baseline; the CSP would need a High authorization or the agency must assess and authorize the additional controls itself

FedRAMP authorizations are tied to a specific impact baseline. A Moderate authorization does not demonstrate that High-baseline controls and enhancements are implemented, so the agency must obtain a High authorization or independently assess and authorize the gap. Inheritance cannot extend beyond the baseline the provider was assessed against.

Under the GDPR, an organization's DPIA for a new high-risk processing activity concludes that residual risk remains high even after proposed mitigations. What does the regulation require the controller to do BEFORE starting the processing?

Answer: Consult the competent supervisory authority under Article 36 prior to processing

GDPR Article 36 requires prior consultation with the supervisory authority when a DPIA indicates the processing would result in high risk in the absence of measures taken by the controller to mitigate it. The 72-hour deadline relates to breach notification under Article 33, not DPIA residual risk, and appointing a DPO does not replace the consultation.

A covered entity under HIPAA discovers that a business associate's subcontractor suffered a breach involving unsecured PHI of 620 individuals in a single state. Which obligation applies to the covered entity under the HIPAA Breach Notification Rule?

Answer: Notify affected individuals and HHS within 60 days of discovery, and notify prominent media outlets in the state, since more than 500 residents are affected

For breaches affecting more than 500 residents of a state, the covered entity must notify individuals without unreasonable delay and no later than 60 days, notify HHS contemporaneously, and notify prominent media outlets serving the state. Breaches by business associates or their subcontractors still trigger the covered entity's obligations, and the annual reporting option applies only to breaches under 500.

A publicly traded company's IT general controls over a key financial application are found to have a design deficiency in change management. Management has also identified that compensating manual reconciliations exist. Under SOX Section 404 and PCAOB AS 2201, what is the BEST next step in evaluating the deficiency?

Answer: Evaluate whether the compensating controls operate at a level of precision that would prevent or detect a material misstatement, then classify severity as a deficiency, significant deficiency, or material weakness

AS 2201 requires evaluating severity based on whether there is a reasonable possibility that controls will fail to prevent or detect a material misstatement. Compensating controls must operate at a sufficient level of precision to be considered. ITGC deficiencies are not automatically material weaknesses, and management cannot exclude identified deficiencies from its assessment.

An organization processes payment card data and uses a third-party service provider that validates its own PCI DSS compliance. The organization's security officer asks how this affects the organization's own PCI DSS responsibilities. Which statement is MOST accurate?

Answer: The organization remains responsible for its own cardholder data environment and must also maintain a responsibility matrix and monitor the provider's compliance status

PCI DSS Requirement 12.8 requires maintaining a list of service providers, written agreements acknowledging responsibility, due diligence, ongoing monitoring of provider compliance status, and documenting which requirements are managed by each party. Outsourcing does not transfer ultimate accountability for the entity's own cardholder data environment.