Compliance and Policy Flashcards

What is the primary purpose of a Regulatory Change Management process within a compliance program?

Answer: To track, assess, and implement changes to applicable laws and regulations

Regulatory Change Management ensures the organization identifies, evaluates, and responds to new or amended regulations affecting its operations.

A healthcare organization must comply with both HIPAA and state privacy laws that are stricter than HIPAA. Which standard should govern their compliance program?

Answer: The state law, because it provides greater protection to individuals

HIPAA allows states to enact stricter privacy protections, and organizations must comply with the more stringent standard.

Which element is MOST critical to include in an organization's written information security policy?

Answer: Scope, roles, responsibilities, and enforcement mechanisms

Effective security policies must define scope, assign roles and responsibilities, and specify how the policy will be enforced.

Under GDPR, what is the maximum timeframe for notifying a supervisory authority after discovering a personal data breach?

Answer: 72 hours

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

An organization's compliance policy requires annual vendor due diligence reviews. A critical vendor's contract renews mid-year without a review. This BEST represents which type of compliance failure?

Answer: An operational failure to execute a defined control

The policy (design) is sound, but the failure to execute the review on schedule is an operational control failure.

What is the role of 'tone at the top' in an effective compliance program?

Answer: Senior leadership visibly demonstrating commitment to ethical conduct and compliance

Tone at the top means senior leadership models and champions ethical behavior, which is a foundational driver of organizational compliance culture.

Which compliance framework is MOST commonly used as a baseline for US federal government contractors handling controlled unclassified information (CUI)?

Answer: NIST SP 800-171

NIST SP 800-171 defines the security requirements for protecting CUI in non-federal systems and is required for most federal contractors.