CISM Compliance and Regulatory Requirements 2

Question 1

A CISM discovers that a new business initiative will require processing of EU citizen data. Which regulation MUST be considered?

Accepted Answer

GDPR

Answer

HIPAA

Answer

GLBA

Answer

FISMA

Question 2

Which of the following is the PRIMARY purpose of a compliance audit?

Accepted Answer

To assess whether the organization's controls meet applicable requirements

Answer

To identify all technical vulnerabilities in the organization's systems

Answer

To evaluate the efficiency of the IT department's operations

Answer

To test employee knowledge of security policies

Question 3

A CISM is informed that regulatory requirements in the organization's industry have changed. The MOST appropriate response is to:

Accepted Answer

Immediately conduct a gap analysis to identify required changes to controls and processes

Answer

Wait until the next scheduled audit to assess the impact

Answer

Outsource all compliance activities to a third-party firm

Answer

Notify the board only after all required changes are implemented

Question 4

Which of the following BEST describes a 'control deficiency' in a compliance context?

Accepted Answer

A failure of a control to operate as intended or meet a required standard

Answer

A security tool that has been deprecated by the vendor

Answer

An employee who has violated an acceptable use policy

Answer

A regulatory requirement that the organization believes is excessive

Question 5

The Federal Information Security Modernization Act (FISMA) PRIMARILY applies to:

Accepted Answer

US federal agencies and contractors that handle federal information

Answer

All US companies with more than 100 employees

Answer

Financial institutions regulated by the Federal Reserve

Answer

Healthcare organizations billing Medicare or Medicaid

Question 6

A CISM is tasked with reducing compliance costs while maintaining all required standards. The BEST approach is to:

Accepted Answer

Implement a common controls framework to satisfy multiple requirements simultaneously

Answer

Reduce the number of regulations the organization monitors

Answer

Negotiate with regulators for reduced audit frequency

Answer

Outsource all compliance functions to reduce internal headcount