CRP Regulatory Compliance & Standards 3

Question 1

A healthcare organization operating in the US must notify affected individuals of a PHI breach within how many days under HIPAA's Breach Notification Rule?

Accepted Answer

60 days

Answer

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 calendar days of discovering a breach of unsecured PHI.

Question 2

Which standard specifically addresses the recovery of IT systems and data and is most closely aligned with BCMS requirements under ISO 22301?

Accepted Answer

ISO/IEC 27031

Answer

ISO/IEC 27031 provides guidelines on concepts and principles for information and communication technology readiness for business continuity, directly complementing ISO 22301.

Question 3

Under NERC CIP standards, a 'high impact' bulk electric system (BES) cyber system must implement which control that 'medium impact' systems may not be required to have?

Accepted Answer

Multi-factor authentication (MFA) for interactive remote access

Answer

NERC CIP-006 and CIP-007 impose additional controls on high-impact BES cyber systems, including mandatory MFA for interactive remote access, which is not required for all medium-impact systems.

Question 4

The Payment Card Industry Data Security Standard (PCI DSS) requires penetration testing to be conducted at minimum how frequently?

Accepted Answer

Annually and after significant infrastructure changes

Answer

PCI DSS Requirement 11.4 mandates penetration testing at least annually and after any significant infrastructure or application upgrades or modifications.

Question 5

A multinational corporation discovers that its BCM program complies with ISO 22301 but not with a new national regulation in one country where it operates. What is the BEST approach?

Accepted Answer

Conduct a jurisdiction-specific gap analysis and develop localized compliance controls

Answer

When international standards and local regulations diverge, the best practice is a jurisdiction-specific gap analysis followed by targeted controls to meet local requirements without abandoning the overarching standard.

(CRP) Certified Resilience Professional Practice Test

(CRP) Certified Resilience Professional Practice Test

CRP Regulatory Compliance & Standards 3