Risk Management and Compliance Flashcards

An organization must choose between accepting, transferring, mitigating, or avoiding a risk. Which option is MOST appropriate for a low-likelihood, low-impact risk where mitigation cost exceeds potential loss?

Answer: Accept the risk and document the decision

When mitigation cost exceeds potential loss for a low-likelihood, low-impact risk, accepting the risk with documented rationale is the most cost-effective decision.

Which metric BEST quantifies the financial impact of a single security incident for risk calculation purposes?

Answer: Single Loss Expectancy (SLE)

SLE = Asset Value × Exposure Factor and represents the expected financial loss from a single occurrence of a specific threat event.

A CASP+ professional conducts a BIA. Which output is MOST critical for defining recovery objectives?

Answer: Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each critical process

RTO (maximum tolerable downtime) and RPO (maximum acceptable data loss) are the primary outputs of a BIA that drive continuity and recovery planning.

Which compliance framework is MOST applicable to a US healthcare organization processing electronic protected health information (ePHI)?

Answer: HIPAA Security Rule

The HIPAA Security Rule mandates administrative, physical, and technical safeguards specifically for ePHI held by covered entities and business associates in the US.

An organization wants to assess the maturity of its information security program. Which framework provides a structured maturity model for this purpose?

Answer: CMMC (Cybersecurity Maturity Model Certification)

CMMC defines progressive maturity levels (1–3) with specific practice requirements, enabling organizations to benchmark and improve their cybersecurity posture.

Which document formally authorizes an information system to operate and accepts residual risk on behalf of the organization?

Answer: Authority to Operate (ATO)

An ATO is the official management decision by an authorizing official (AO) accepting the residual risk and granting permission for the system to operate.