Regulatory Requirements Flashcards

A federal civilian agency's system owner proposes to reuse the authorization of a commercial cloud service that already holds a FedRAMP Authorization to Operate (ATO) from another agency. The system will process data categorized as Moderate impact. Under the FedRAMP reuse model and NIST SP 800-37 Rev. 2, which action best reflects the agency's responsibility before it grants its own ATO?

Answer: Review the CSP's authorization package, assess the agency-specific controls and inherited/customer-responsible controls, and have the agency's authorizing official make a risk-based decision to issue its own ATO

FedRAMP uses a 'do once, use many times' model, but the agency's authorizing official remains accountable for the risk decision. The agency reviews the existing package, evaluates customer-responsible and agency-specific controls, and issues its own ATO. It does not blindly accept the authorization, nor must it repeat the full 3PAO assessment, and ISO 27001 certification does not replace the required assessment.

An organization is a covered entity under HIPAA and uses a cloud-hosted analytics platform that stores ePHI. The platform vendor has refused to sign a business associate agreement (BAA), stating that it only stores encrypted data and does not hold the encryption keys. From a regulatory compliance standpoint, how should a CGRC practitioner assess this situation?

Answer: The arrangement is noncompliant, because a cloud service provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity is a business associate even without access to the keys, so a BAA is required

HHS guidance states that a CSP that maintains ePHI is a business associate, even if it stores only encrypted data and lacks the decryption key. A BAA is required under 45 CFR 164.308(b) and 164.502(e). Neither a SOC 2 report nor a risk analysis replaces the BAA requirement.

A US-based SaaS company with no physical presence in the EU offers a subscription service to the public in several languages and accepts payment in euros. It monitors the behavior of users located in Germany through analytics cookies. Which statement most accurately describes its GDPR obligations?

Answer: GDPR applies under its extraterritorial scope, and the company generally must designate an EU representative under Article 27 unless a limited exemption applies

Article 3(2) applies GDPR to non-EU controllers that offer goods or services to people in the EU or monitor their behavior there. Article 27 generally requires such controllers to designate an EU representative, subject to narrow exemptions (occasional, low-risk processing). The 250-employee threshold only affects recordkeeping under Article 30, and SCCs address transfers, not the full set of obligations.

A publicly traded company's security team discovers a ransomware incident on a Monday. After a preliminary assessment, the team believes the incident may materially affect the company's financial condition, but the full scope is not yet known. Under the SEC cybersecurity disclosure rules adopted in 2023, what is the correct timing requirement?

Answer: File Form 8-K within four business days after the company determines the incident is material, and make that materiality determination without unreasonable delay

The SEC rules (Item 1.05 of Form 8-K) require disclosure within four business days after the company determines that a cybersecurity incident is material, and the determination must be made without unreasonable delay after discovery. The clock starts at the materiality determination, not at discovery. The 72-hour period is GDPR's supervisory authority notification standard. A delay is permitted only if the U.S. Attorney General determines that disclosure poses a substantial risk to national security or public safety.

A defense contractor handles Controlled Unclassified Information (CUI) and subcontracts part of the work to a vendor that will also store CUI. Under DFARS 252.204-7012 and related CMMC requirements, which obligation best describes the prime contractor's responsibility?

Answer: The prime must flow down the DFARS clause to subcontractors that handle covered defense information and ensure the required security protections, including NIST SP 800-171 controls, are in place

DFARS 252.204-7012 requires prime contractors to flow down the clause to subcontractors whose performance involves covered defense information, and to ensure those subcontractors provide adequate security (NIST SP 800-171). CMMC applies similar flow-down by requiring subcontractors to hold the appropriate certification level for the data they handle. FedRAMP is required for external cloud service providers storing CDI, but this is not a blanket FedRAMP High requirement.

An agency is preparing to transition a system from an annual reauthorization cycle to ongoing authorization under NIST SP 800-37 Rev. 2. Which condition is required for the authorizing official to make this transition?

Answer: An effective information security continuous monitoring (ISCM) strategy must be in place, and the AO must be able to monitor the system's risk using ongoing assessment of controls, with the authorization decision based on the ISCM-produced risk information

SP 800-37 Rev. 2 permits ongoing authorization once the system has an initial authorization and an ISCM program is in place that gives the AO sufficient, near-real-time information to understand and accept risk. Neither a Low impact level nor a 3PAO assessment is required, and zero residual risk is not a requirement because risk acceptance is a core AO function.