Compliance and Policy Flashcards

Which regulation requires US federal agencies to implement risk-based information security programs and report to Congress annually?

Answer: FISMA

FISMA (Federal Information Security Modernization Act) mandates risk-based security programs and annual congressional reporting for federal agencies.

A company discovers that an employee has been sharing customer PII with an unauthorized third party. Under a compliance framework, what is the FIRST action the compliance officer should take?

Answer: Invoke the incident response plan

Invoking the incident response plan ensures a structured, documented approach to containing and assessing the breach before other actions.

What does the term 'policy exception' refer to in a compliance program?

Answer: A documented deviation from policy with defined compensating controls and approval

A policy exception is a formally documented, approved deviation that includes compensating controls and a defined expiration date.

Which component ensures that employees understand their compliance obligations before they can access systems or data?

Answer: Security awareness training and acknowledgment

Security awareness training with acknowledgment signatures ensures employees are informed of and accountable for compliance obligations.

Under SOX Section 302, who is primarily responsible for certifying the accuracy of financial disclosures?

Answer: CEO and CFO

SOX Section 302 requires the CEO and CFO to personally certify the accuracy of financial statements and internal controls.

A policy states that all passwords must be changed every 90 days. An employee with a disability cannot remember frequently changing passwords. What is the BEST compliance approach?

Answer: Document a formal exception with compensating controls such as MFA

A documented exception with compensating controls like MFA maintains security intent while accommodating the employee's needs.

Which of the following BEST describes the purpose of a compliance monitoring program?

Answer: To detect policy violations and assess control effectiveness on an ongoing basis

Compliance monitoring provides continuous assessment of whether controls are operating effectively and policies are being followed.