CISM Compliance and Regulatory Requirements

Question 1

Which US federal law PRIMARILY governs the protection of personal health information in the healthcare industry?

Accepted Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

HIPAA establishes federal standards for protecting the privacy and security of individually identifiable health information in the US healthcare industry.

Question 2

A CISM is developing a compliance program. The FIRST step should be to:

Accepted Answer

Identify all applicable laws, regulations, and contractual obligations

Answer

Identifying all applicable regulatory, legal, and contractual requirements is the foundational step before any compliance program activities can be structured.

Question 3

Under the Sarbanes-Oxley Act (SOX), which of the following is a KEY information security requirement?

Accepted Answer

Internal controls over financial reporting, including IT general controls

Answer

SOX requires organizations to establish and maintain internal controls over financial reporting, which includes IT general controls that protect the integrity of financial systems.

Question 4

Which of the following is MOST important when mapping security controls to regulatory requirements?

Accepted Answer

Using a unified control framework to address multiple requirements efficiently

Answer

A unified control framework maps controls to multiple regulations simultaneously, reducing duplication and improving efficiency across compliance programs.

Question 5

Which of the following BEST describes the difference between a regulation and a standard in the context of compliance?

Accepted Answer

Regulations are legally mandated by governments; standards are typically voluntary industry guidelines

Answer

Regulations are legally enforceable requirements imposed by government authorities, while standards are generally voluntary guidelines developed by industry bodies.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Compliance and Regulatory Requirements