Regulatory Compliance & Standards Flashcards
7 cards from real CRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Standards flashcards as text
Which regulatory body enforces business continuity requirements for US broker-dealers and investment advisers under Rule 17a-4 and related regulations?
Answer: Securities and Exchange Commission (SEC)
The SEC enforces records retention and business continuity requirements for broker-dealers under Rule 17a-4, while FINRA Rule 4370 separately governs BCPs for FINRA members.
An organization certified to ISO 22301 undergoes a surveillance audit 12 months after initial certification. The auditor finds a minor nonconformity. What is the TYPICAL outcome?
Answer: The organization receives a corrective action request with a defined timeframe to resolve the issue
Minor nonconformities found during surveillance audits result in corrective action requests (CARs) with agreed timelines for resolution, not immediate suspension or recertification.
The concept of 'safe harbor' in breach notification laws typically means that organizations are protected from enforcement actions if they demonstrate which of the following?
Answer: The breached data was encrypted with industry-standard encryption at the time of the incident
Many US state breach notification laws and HIPAA provide safe harbor provisions when breached data was encrypted with current industry-standard encryption, because encrypted data is not usable by unauthorized parties.
GDPR Article 32 requires organizations to implement appropriate technical and organizational measures to ensure security of personal data. Which BCM practice BEST satisfies this obligation?
Answer: Implementing and regularly testing data backup and recovery procedures
Article 32 explicitly mentions the ability to restore data availability and access after incidents, making tested backup and recovery procedures the most direct BCM control satisfying this requirement.
Which framework provides sector-specific cybersecurity guidance for US healthcare organizations and is referenced by HHS Office for Civil Rights as a recognized security framework?
Answer: HITRUST CSF
The HITRUST Common Security Framework (CSF) is specifically designed for healthcare and is recognized by HHS OCR as a comprehensive framework that incorporates HIPAA requirements alongside other security standards.
When a US state's data breach notification law conflicts with HIPAA's breach notification requirements by imposing a shorter notification window, which requirement must the covered entity follow?
Answer: Follow whichever law provides greater protection to individuals (typically the shorter timeframe)
HIPAA's preemption rules require compliance with state laws that are more protective of patient privacy; a shorter state notification window provides greater protection and must be followed.
The Business Continuity Institute (BCI) Good Practice Guidelines (GPG) are BEST described as which type of document?
Answer: A voluntary professional practice guide that complements certifiable standards like ISO 22301
The BCI GPG is a voluntary best practice guide that provides detailed professional guidance on BCM, complementing rather than replacing certifiable standards like ISO 22301.