CISM Compliance and Regulatory Requirements 2

Question 1

A CISM discovers that a new business initiative will require processing of EU citizen data. Which regulation MUST be considered?

Accepted Answer

GDPR

Answer

The General Data Protection Regulation (GDPR) applies to any organization processing personal data of EU residents, regardless of where the organization is located.

Question 2

Which of the following is the PRIMARY purpose of a compliance audit?

Accepted Answer

To assess whether the organization's controls meet applicable requirements

Answer

A compliance audit evaluates whether an organization's controls, processes, and practices meet the requirements of applicable laws, regulations, or standards.

Question 3

A CISM is informed that regulatory requirements in the organization's industry have changed. The MOST appropriate response is to:

Accepted Answer

Immediately conduct a gap analysis to identify required changes to controls and processes

Answer

A prompt gap analysis identifies what the new requirements demand and where current controls fall short, enabling timely and prioritized remediation.

Question 4

Which of the following BEST describes a 'control deficiency' in a compliance context?

Accepted Answer

A failure of a control to operate as intended or meet a required standard

Answer

A control deficiency is a gap where a control either doesn't exist, fails to operate as designed, or fails to meet the required standard.

Question 5

The Federal Information Security Modernization Act (FISMA) PRIMARILY applies to:

Accepted Answer

US federal agencies and contractors that handle federal information

Answer

FISMA applies to US federal agencies and contractors that handle federal information, requiring them to develop, document, and implement information security programs.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Compliance and Regulatory Requirements 2