CGRC Policy Development 3 — Questions and Answers
Question 1: When mapping policies to regulatory requirements, the MAIN benefit is to:
- Reduce the number of policies required
- Identify coverage gaps and demonstrate compliance traceability (Correct answer)
- Eliminate the need for internal audits
- Automate policy enforcement
Correct answer: Identify coverage gaps and demonstrate compliance traceability
Mapping creates a crosswalk that shows which policies address which regulations, revealing gaps and simplifying audit evidence collection.
Question 2: Which of the following BEST describes a 'baseline standard' in the context of policy development?
- A policy that applies only to executives
- A minimum set of mandatory requirements derived from policy (Correct answer)
- A guideline that employees may choose to follow
- A procedure for onboarding new vendors
Correct answer: A minimum set of mandatory requirements derived from policy
Baseline standards establish mandatory minimum requirements that operationalize a policy, ensuring consistent implementation across the organization.
Question 3: Policy communication strategies should PRIMARILY ensure that:
- Policies are accessible only to compliance staff
- All affected parties are aware of and understand their obligations (Correct answer)
- Policy documents remain confidential to reduce risk
- Only managers receive policy training
Correct answer: All affected parties are aware of and understand their obligations
Effective policy communication ensures that everyone subject to the policy understands their responsibilities, which is essential for compliance.
Question 4: In the NIST Cybersecurity Framework context, policies MOST directly support which function?
- Detect
- Respond
- Govern/Identify (Correct answer)
- Recover
Correct answer: Govern/Identify
The Govern/Identify function encompasses organizational policies, risk management strategy, and the governance structures that enable cybersecurity.
Question 5: What does 'policy harmonization' mean in a multi-regulatory environment?
- Writing separate policies for each regulation
- Aligning policies to satisfy multiple regulatory requirements simultaneously (Correct answer)
- Delegating policy ownership to each business unit separately
- Removing conflicting policies from the policy library
Correct answer: Aligning policies to satisfy multiple regulatory requirements simultaneously
Harmonization creates unified policies that satisfy multiple overlapping regulations, reducing redundancy and compliance overhead.
Question 6: Which element in a policy helps employees understand what happens if they do not comply?
- Purpose statement
- Scope section
- Enforcement and consequences section (Correct answer)
- References section
Correct answer: Enforcement and consequences section
The enforcement section communicates disciplinary actions or consequences for non-compliance, reinforcing the policy's authority.
Question 7: A policy that uses language such as 'should' rather than 'shall' or 'must' creates which issue?
- It makes the policy easier to read for all employees
- It implies the requirement is optional, weakening enforceability (Correct answer)
- It broadens the policy scope unnecessarily
- It reduces the review cycle frequency
Correct answer: It implies the requirement is optional, weakening enforceability
Modal verbs like 'should' denote recommendations, while 'shall' and 'must' denote mandatory requirements; mixing them creates ambiguity about obligations.
CGRC Policy Development 3
When mapping policies to regulatory requirements, the MAIN benefit is to: