CGRC Compliance and Policy 5

Question 1

Under the NIST Cybersecurity Framework, which function focuses on developing an organizational understanding of cybersecurity risk to systems, assets, data, and capabilities?

Accepted Answer

Identify

Answer

The Identify function encompasses asset management, business environment, governance, risk assessment, and risk management strategy.

Question 2

A financial services firm is subject to the Gramm-Leach-Bliley Act (GLBA). Which rule requires the firm to implement a comprehensive information security program?

Accepted Answer

The Safeguards Rule

Answer

The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security program.

Question 3

What is the PRIMARY goal of a compliance training needs assessment?

Accepted Answer

To identify which employee groups face which compliance risks and tailor training accordingly

Answer

A training needs assessment maps compliance risk exposure by role or function so training content and frequency can be appropriately targeted.

Question 4

When documenting a compliance policy, which attribute is MOST important to include to ensure the policy remains enforceable and current?

Accepted Answer

Version number, effective date, review date, and policy owner

Answer

Version control, effective and review dates, and an identified owner ensure the policy can be tracked, maintained, and enforced over time.

Question 5

Which of the following is an example of a preventive compliance control?

Accepted Answer

Requiring dual authorization for wire transfers over a threshold

Answer

Dual authorization prevents unauthorized transactions from occurring in the first place, making it a preventive rather than detective or corrective control.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Compliance and Policy 5