Risk Management and Compliance Flashcards

Which artifact documents identified control deficiencies and tracks remediation activities with milestones and responsible parties?

Answer: Plan of Action and Milestones (POA&M)

A POA&M formally tracks each identified weakness, the corrective action planned, the responsible party, and the scheduled completion date.

An organization performs a gap analysis against ISO 27001. Which output BEST prioritizes remediation efforts?

Answer: A risk-ranked list of control gaps with associated residual risk levels

Risk-ranking gaps by residual risk ensures that the most dangerous deficiencies are remediated first, optimizing the allocation of limited security resources.

Which standard specifically defines requirements for payment card data security applicable to merchants and service providers?

Answer: PCI DSS (Payment Card Industry Data Security Standard)

PCI DSS is the global security standard mandated by card brands (Visa, Mastercard, etc.) for any organization that stores, processes, or transmits cardholder data.

A CASP+ professional is building a vendor risk management program. Which assessment type provides the MOST assurance about a cloud provider's security controls?

Answer: SOC 2 Type II report from an independent auditor

A SOC 2 Type II report documents testing of controls over a period (typically 6–12 months) by an independent auditor, providing high-confidence evidence of operational effectiveness.

Which risk management framework does NIST recommend for federal information systems and is widely adopted in the US private sector?

Answer: NIST Risk Management Framework (RMF)

NIST RMF (SP 800-37) provides a structured, six-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) for managing information system risk.

An organization identifies that a critical control is not cost-effective to implement. Which control type can be used to partially offset the risk without fully replacing the missing control?

Answer: Compensating control

Compensating controls are alternative measures that provide equivalent or partial risk reduction when the primary control cannot be implemented as specified.