CISM Compliance and Regulatory Requirements

Question 1

Which US federal law PRIMARILY governs the protection of personal health information in the healthcare industry?

Accepted Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

Sarbanes-Oxley Act (SOX)

Answer

Gramm-Leach-Bliley Act (GLBA)

Answer

Children's Online Privacy Protection Act (COPPA)

Question 2

A CISM is developing a compliance program. The FIRST step should be to:

Accepted Answer

Identify all applicable laws, regulations, and contractual obligations

Answer

Purchase GRC (governance, risk, compliance) software

Answer

Conduct an internal audit of all existing controls

Answer

Assign compliance responsibilities to the legal team only

Question 3

Under the Sarbanes-Oxley Act (SOX), which of the following is a KEY information security requirement?

Accepted Answer

Internal controls over financial reporting, including IT general controls

Answer

Encryption of all employee communications

Answer

Annual penetration testing of all public-facing systems

Answer

Mandatory security awareness training for all employees

Question 4

Which of the following is MOST important when mapping security controls to regulatory requirements?

Accepted Answer

Using a unified control framework to address multiple requirements efficiently

Answer

Implementing a separate set of controls for each regulation

Answer

Delegating control mapping entirely to external auditors

Answer

Focusing only on the most recent regulatory guidance

Question 5

Which of the following BEST describes the difference between a regulation and a standard in the context of compliance?

Accepted Answer

Regulations are legally mandated by governments; standards are typically voluntary industry guidelines

Answer

Regulations are optional; standards are mandatory

Answer

Standards are enforced by government agencies; regulations are created by industry groups

Answer

There is no practical difference between regulations and standards

Question 6

The Payment Card Industry Data Security Standard (PCI DSS) applies to organizations that:

Accepted Answer

Store, process, or transmit cardholder data

Answer

Process payroll for more than 500 employees

Answer

Operate in the financial services sector only

Answer

Issue credit cards directly to consumers