CGRC Compliance and Policy 2

Question 1

Which regulation requires US federal agencies to implement risk-based information security programs and report to Congress annually?

Accepted Answer

FISMA

Answer

FISMA (Federal Information Security Modernization Act) mandates risk-based security programs and annual congressional reporting for federal agencies.

Question 2

A company discovers that an employee has been sharing customer PII with an unauthorized third party. Under a compliance framework, what is the FIRST action the compliance officer should take?

Accepted Answer

Invoke the incident response plan

Answer

Invoking the incident response plan ensures a structured, documented approach to containing and assessing the breach before other actions.

Question 3

What does the term 'policy exception' refer to in a compliance program?

Accepted Answer

A documented deviation from policy with defined compensating controls and approval

Answer

A policy exception is a formally documented, approved deviation that includes compensating controls and a defined expiration date.

Question 4

Which component ensures that employees understand their compliance obligations before they can access systems or data?

Accepted Answer

Security awareness training and acknowledgment

Answer

Security awareness training with acknowledgment signatures ensures employees are informed of and accountable for compliance obligations.

Question 5

Under SOX Section 302, who is primarily responsible for certifying the accuracy of financial disclosures?

Accepted Answer

CEO and CFO

Answer

SOX Section 302 requires the CEO and CFO to personally certify the accuracy of financial statements and internal controls.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Compliance and Policy 2