CGRC Policy Development 3

Question 1

When mapping policies to regulatory requirements, the MAIN benefit is to:

Accepted Answer

Identify coverage gaps and demonstrate compliance traceability

Answer

Mapping creates a crosswalk that shows which policies address which regulations, revealing gaps and simplifying audit evidence collection.

Question 2

Which of the following BEST describes a 'baseline standard' in the context of policy development?

Accepted Answer

A minimum set of mandatory requirements derived from policy

Answer

Baseline standards establish mandatory minimum requirements that operationalize a policy, ensuring consistent implementation across the organization.

Question 3

Policy communication strategies should PRIMARILY ensure that:

Accepted Answer

All affected parties are aware of and understand their obligations

Answer

Effective policy communication ensures that everyone subject to the policy understands their responsibilities, which is essential for compliance.

Question 4

In the NIST Cybersecurity Framework context, policies MOST directly support which function?

Accepted Answer

Govern/Identify

Answer

The Govern/Identify function encompasses organizational policies, risk management strategy, and the governance structures that enable cybersecurity.

Question 5

What does 'policy harmonization' mean in a multi-regulatory environment?

Accepted Answer

Aligning policies to satisfy multiple regulatory requirements simultaneously

Answer

Harmonization creates unified policies that satisfy multiple overlapping regulations, reducing redundancy and compliance overhead.

CGRC - Certified Governance Risk and Compliance Practice Test