Regulatory Compliance & Standards Flashcards
7 cards from real CRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Standards flashcards as text
A healthcare organization operating in the US must notify affected individuals of a PHI breach within how many days under HIPAA's Breach Notification Rule?
Answer: 60 days
HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 calendar days of discovering a breach of unsecured PHI.
Which standard specifically addresses the recovery of IT systems and data and is most closely aligned with BCMS requirements under ISO 22301?
Answer: ISO/IEC 27031
ISO/IEC 27031 provides guidelines on concepts and principles for information and communication technology readiness for business continuity, directly complementing ISO 22301.
Under NERC CIP standards, a 'high impact' bulk electric system (BES) cyber system must implement which control that 'medium impact' systems may not be required to have?
Answer: Multi-factor authentication (MFA) for interactive remote access
NERC CIP-006 and CIP-007 impose additional controls on high-impact BES cyber systems, including mandatory MFA for interactive remote access, which is not required for all medium-impact systems.
The Payment Card Industry Data Security Standard (PCI DSS) requires penetration testing to be conducted at minimum how frequently?
Answer: Annually and after significant infrastructure changes
PCI DSS Requirement 11.4 mandates penetration testing at least annually and after any significant infrastructure or application upgrades or modifications.
A multinational corporation discovers that its BCM program complies with ISO 22301 but not with a new national regulation in one country where it operates. What is the BEST approach?
Answer: Conduct a jurisdiction-specific gap analysis and develop localized compliance controls
When international standards and local regulations diverge, the best practice is a jurisdiction-specific gap analysis followed by targeted controls to meet local requirements without abandoning the overarching standard.
Which element of the US National Preparedness System is most directly relevant to private sector organizations developing regulatory-compliant resilience programs?
Answer: National Infrastructure Protection Plan (NIPP)
The NIPP provides the framework for how the public and private sectors work together to manage risks to critical infrastructure, directly guiding private sector resilience and compliance programs.
In ISO 22301:2019, what does the term 'interested parties' refer to in the context of understanding the organization's context?
Answer: Individuals or organizations that can affect, be affected by, or perceive themselves to be affected by the BCMS
ISO 22301:2019 defines interested parties (stakeholders) broadly as any individual or organization that can affect, be affected by, or perceive themselves affected by the BCMS, requiring their needs and expectations to be understood.