Practice Test Geeks(CRP) Certified Resilience Professional Practice Test
← All CRP Flashcard Decks

Regulatory Compliance & Standards Flashcards

7 cards from real CRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Regulatory Compliance & Standards flashcards as text

  1. Under the FFIEC Business Continuity Management Booklet, financial institutions are expected to develop resilience strategies based on which primary risk assessment driver?

    Answer: Business impact analysis (BIA) findings that determine criticality and recovery time objectives

    The FFIEC BCM Booklet emphasizes that BIA findings — including RTO and RPO determinations — must drive the selection of resilience strategies for financial institutions.

  2. ISO 22301:2019 requires organizations to evaluate the performance and effectiveness of their BCMS. Which of the following is a required method for this evaluation?

    Answer: Internal audits at planned intervals

    ISO 22301:2019 Clause 9.2 explicitly requires internal audits at planned intervals to determine whether the BCMS conforms to requirements and is effectively implemented.

  3. A company subject to SEC Regulation SCI (Systems Compliance and Integrity) must notify the SEC of a significant systems disruption within how many hours?

    Answer: 4 hours

    SEC Regulation SCI requires SCI entities to notify the SEC of significant systems disruptions or intrusions within 24 hours, with an initial notification within four hours for the most severe events.

  4. Which provision of the Dodd-Frank Wall Street Reform Act most directly affects BCM requirements for systemically important financial institutions (SIFIs)?

    Answer: Title I — Financial Stability Oversight Council designation and enhanced prudential standards

    Dodd-Frank Title I designates SIFIs and subjects them to enhanced prudential standards enforced by the Federal Reserve, which include stress testing and resolution planning requirements central to BCM.

  5. When an organization's BCM program is audited against multiple overlapping standards (e.g., ISO 22301, NFPA 1600, and FFIEC), which approach is MOST effective for managing compliance efficiently?

    Answer: Implement a unified control framework that maps controls to all applicable standards simultaneously

    A unified control framework with cross-reference mapping allows organizations to implement controls once and demonstrate compliance with multiple standards simultaneously, reducing duplication and cost.

  6. The concept of 'regulatory horizon scanning' in a BCM compliance program refers to which activity?

    Answer: Proactively identifying and tracking emerging regulations and standards that may affect the BCM program

    Regulatory horizon scanning is a proactive practice of monitoring legislative, regulatory, and standards-setting bodies to anticipate future requirements before they become mandatory.

  7. Under NFPA 1600 (Standard on Continuity, Emergency, and Crisis Management), which element distinguishes it from ISO 22301 in its scope?

    Answer: NFPA 1600 encompasses emergency management and crisis management in addition to business continuity, giving it a broader scope than ISO 22301

    NFPA 1600 has a broader scope than ISO 22301 by explicitly encompassing emergency management, crisis management, and continuity of operations in addition to business continuity management.