Risk Management & Compliance Flashcards

Which risk treatment option involves transferring the financial impact of a risk to a third party?

Answer: Risk transference

Risk transference shifts the financial burden of a risk to another party, such as purchasing cyber insurance.

In NIST SP 800-30, what is the correct order of the risk assessment process?

Answer: Identify threats, identify vulnerabilities, determine likelihood, determine impact

NIST SP 800-30 follows: identify threats, identify vulnerabilities, determine likelihood, then determine impact to derive overall risk.

Which compliance framework specifically addresses the security of payment card data?

Answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for organizations that handle credit and debit card transactions.

A quantitative risk analysis assigns monetary values to risk. What does the term 'Annual Loss Expectancy (ALE)' represent?

Answer: The product of SLE and ARO

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), giving the expected yearly financial loss.

Which document formally authorizes an information system to operate and accepts the residual risk?

Answer: Authority to Operate (ATO)

An Authority to Operate (ATO) is issued by an authorizing official, formally accepting residual risk and permitting system operation.

Under HIPAA, which rule specifically requires covered entities to implement administrative, physical, and technical safeguards for electronic PHI?

Answer: Security Rule

The HIPAA Security Rule requires covered entities to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Which risk analysis method uses expert opinion and descriptive ratings such as 'High,' 'Medium,' and 'Low' rather than numerical values?

Answer: Qualitative analysis

Qualitative risk analysis uses subjective ratings and expert judgment instead of precise monetary or numerical calculations.

Which NIST publication provides guidance specifically on the Risk Management Framework (RMF)?

Answer: NIST SP 800-37

NIST SP 800-37 describes the Risk Management Framework (RMF) for federal information systems, outlining six steps from categorization to continuous monitoring.

An organization discovers a vulnerability but decides no action is needed because the cost of mitigation exceeds the asset's value. This decision is an example of:

Answer: Risk acceptance

Risk acceptance (also called risk retention) occurs when management consciously chooses to accept a risk, often because mitigation costs outweigh potential loss.

Which SOX section holds executives personally accountable for the accuracy of financial reports and the effectiveness of internal controls?

Answer: Section 302

SOX Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements and the effectiveness of internal controls.

In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

Answer: The maximum acceptable downtime before business impact becomes critical

RTO is the maximum acceptable length of time a system can be offline before the impact on the business becomes unacceptable.

Which framework uses a five-function structure — Identify, Protect, Detect, Respond, Recover — for managing cybersecurity risk?

Answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

A threat agent exploits a software vulnerability to gain unauthorized access. In risk terminology, what is the 'threat agent'?

Answer: The entity that takes advantage of the vulnerability

A threat agent (or threat actor) is the person, group, or entity that initiates and carries out an attack by exploiting a vulnerability.

Which GDPR principle requires that personal data be collected only for specified, explicit, and legitimate purposes?

Answer: Purpose limitation

The GDPR principle of purpose limitation restricts organizations from using personal data for purposes beyond what was originally specified at collection.

Which step of the NIST RMF involves categorizing information systems based on the potential impact of a security breach?

Answer: Categorize

The Categorize step uses FIPS 199 and NIST SP 800-60 to classify systems based on the potential impact (low, moderate, high) of a confidentiality, integrity, or availability breach.

An organization wants to comply with ISO/IEC 27001. Which document serves as the foundation by defining the scope, objectives, and boundaries of the Information Security Management System (ISMS)?

Answer: Statement of Applicability (SoA)

The Statement of Applicability (SoA) documents which ISO/IEC 27001 Annex A controls are applicable and justified for the organization's ISMS scope.

During a risk assessment, an analyst finds that a web server is exposed to SQL injection. The vulnerability is the weakness, and the threat is malicious input. What is the 'risk' in this scenario?

Answer: The probability that the SQL injection succeeds combined with the resulting impact

Risk is the combination of the likelihood that a threat exploits a vulnerability and the potential impact of that exploitation.

Which compliance regulation applies to US financial institutions and requires them to protect the security and confidentiality of customer financial information?

Answer: GLBA

The Gramm-Leach-Bliley Act (GLBA) requires US financial institutions to implement safeguards to protect nonpublic personal financial information.

In risk management, the 'residual risk' is best described as:

Answer: Risk that remains after security controls have been applied

Residual risk is the level of risk that remains after risk mitigation controls have been implemented; it must be accepted by management.

Which federal law mandates that US government agencies implement information security programs and report to OMB annually?

Answer: FISMA

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document, and implement agency-wide information security programs.