CRP Regulatory Compliance & Standards 2

Question 1

Which NIST publication provides the framework most commonly used for cybersecurity risk management in US critical infrastructure?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) was specifically developed to help critical infrastructure organizations manage cybersecurity risk using a voluntary, risk-based approach.

Question 2

Under HIPAA's Security Rule, which of the following is classified as an 'addressable' implementation specification rather than a 'required' one?

Accepted Answer

Workforce training on security policies

Answer

Workforce security training is an addressable specification, meaning organizations must assess whether it is reasonable and appropriate, whereas risk analysis and audit controls are required.

Question 3

The Sarbanes-Oxley Act (SOX) Section 404 primarily requires publicly traded companies to do which of the following?

Accepted Answer

Assess and report on the effectiveness of internal controls over financial reporting

Answer

SOX Section 404 mandates that management and external auditors assess and report on the effectiveness of internal controls over financial reporting.

Question 4

ISO 22313 serves what role in relation to ISO 22301?

Accepted Answer

It provides guidance and interpretation for implementing ISO 22301

Answer

ISO 22313 is the guidance document that supports ISO 22301 by explaining its requirements and providing best practice advice for implementing a BCMS.

Question 5

Which US federal regulation specifically governs business continuity and disaster recovery planning for federally regulated financial institutions?

Accepted Answer

All of the above represent applicable guidance

Answer

Federally regulated financial institutions are subject to multiple overlapping guidelines including FFIEC booklets, FDIC rules, and OCC bulletins that collectively govern BCM programs.

(CRP) Certified Resilience Professional Practice Test

(CRP) Certified Resilience Professional Practice Test

CRP Regulatory Compliance & Standards 2