CGRC Regulatory Requirements 5

Question 1

Which NIST publication provides a voluntary framework for organizations to manage and reduce cybersecurity risk, widely referenced in regulatory compliance contexts?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) provides a voluntary, risk-based approach to managing cybersecurity risk, organized around five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 2

Under GDPR, a Data Protection Impact Assessment (DPIA) is required when processing is likely to result in high risk. Which scenario most clearly triggers a mandatory DPIA?

Accepted Answer

Large-scale systematic monitoring of publicly accessible areas

Answer

GDPR Article 35 requires a DPIA for large-scale systematic monitoring of publicly accessible areas, as this type of processing is likely to result in high risk to individuals' rights.

Question 3

The New York State Department of Financial Services (NYDFS) Cybersecurity Regulation (23 NYCRR 500) requires covered entities to designate which role?

Accepted Answer

Chief Information Security Officer (CISO)

Answer

NYDFS 23 NYCRR 500 requires covered entities to designate a qualified Chief Information Security Officer (CISO) responsible for overseeing and implementing the cybersecurity program.

Question 4

Under the EU-U.S. Data Privacy Framework, what mechanism allows U.S. organizations to lawfully transfer personal data from the EU?

Accepted Answer

Self-certification to the DPF program

Answer

U.S. organizations can lawfully receive personal data from the EU by self-certifying to the EU-U.S. Data Privacy Framework administered by the U.S. Department of Commerce.

Question 5

ISO/IEC 27001 requires organizations to establish, implement, maintain, and continually improve what type of system?

Accepted Answer

Information security management system (ISMS)

Answer

ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Regulatory Requirements 5