Regulatory Compliance & Standards Flashcards
7 cards from real CRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Standards flashcards as text
Which NIST publication provides the framework most commonly used for cybersecurity risk management in US critical infrastructure?
Answer: NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework (CSF) was specifically developed to help critical infrastructure organizations manage cybersecurity risk using a voluntary, risk-based approach.
Under HIPAA's Security Rule, which of the following is classified as an 'addressable' implementation specification rather than a 'required' one?
Answer: Workforce training on security policies
Workforce security training is an addressable specification, meaning organizations must assess whether it is reasonable and appropriate, whereas risk analysis and audit controls are required.
The Sarbanes-Oxley Act (SOX) Section 404 primarily requires publicly traded companies to do which of the following?
Answer: Assess and report on the effectiveness of internal controls over financial reporting
SOX Section 404 mandates that management and external auditors assess and report on the effectiveness of internal controls over financial reporting.
ISO 22313 serves what role in relation to ISO 22301?
Answer: It provides guidance and interpretation for implementing ISO 22301
ISO 22313 is the guidance document that supports ISO 22301 by explaining its requirements and providing best practice advice for implementing a BCMS.
Which US federal regulation specifically governs business continuity and disaster recovery planning for federally regulated financial institutions?
Answer: All of the above represent applicable guidance
Federally regulated financial institutions are subject to multiple overlapping guidelines including FFIEC booklets, FDIC rules, and OCC bulletins that collectively govern BCM programs.
In the context of the EU's DORA (Digital Operational Resilience Act), which financial entities are primarily subject to its requirements?
Answer: A broad range of financial entities including banks, insurance firms, and ICT third-party service providers
DORA applies broadly to financial entities such as banks, insurance companies, investment firms, crypto-asset service providers, and their critical ICT third-party providers.
What is the primary purpose of a compliance gap analysis in a business continuity program?
Answer: To identify differences between current BCM practices and required regulatory or standards-based requirements
A compliance gap analysis compares existing BCM program elements against applicable regulations or standards to identify deficiencies that must be remediated.