CSL CSL Government & Critical Infrastructure Security Law 2 — Questions and Answers
Question 1: The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards are mandatory for electric utilities. Which federal agency enforces these standards?
- CISA
- DOE
- FERC (Correct answer)
- EPA
Correct answer: FERC
The Federal Energy Regulatory Commission (FERC) has authority under the Energy Policy Act of 2005 to approve and enforce NERC CIP reliability standards for the bulk power system.
Question 2: Which provision of the National Defense Authorization Act (NDAA) addresses cybersecurity requirements for defense contractors handling Controlled Unclassified Information (CUI)?
- FAR cybersecurity clauses
- DFARS 252.204-7012 and CMMC requirements (Correct answer)
- Executive Order 13556
- FISMA moderate baseline requirements
Correct answer: DFARS 252.204-7012 and CMMC requirements
DFARS clause 252.204-7012 requires defense contractors to implement NIST SP 800-171 controls, with the Cybersecurity Maturity Model Certification (CMMC) program expanding and formalizing these requirements.
Question 3: Under the Federal Acquisition Regulation (FAR), a software vendor sells code to the government that contains a known vulnerability the vendor failed to disclose. This may constitute:
- A breach of implied warranty only
- False Claims Act liability for false certification of security compliance (Correct answer)
- A FISMA violation attributable to the agency
- No liability as software is sold 'as-is'
Correct answer: False Claims Act liability for false certification of security compliance
If a vendor falsely certifies compliance with cybersecurity requirements in a government contract, they may face liability under the False Claims Act, which provides treble damages.
Question 4: The TSA cybersecurity directives issued after the Colonial Pipeline attack apply to which sector and require what primary security measure?
- Water sector; mandatory CISA reporting
- Pipeline and rail sectors; network segmentation and incident reporting (Correct answer)
- Financial sector; zero trust architecture
- Healthcare sector; ransomware playbooks
Correct answer: Pipeline and rail sectors; network segmentation and incident reporting
TSA issued emergency cybersecurity directives to pipeline and surface transportation operators requiring network segmentation, cybersecurity coordinator designation, and CISA incident reporting.
Question 5: Under what authority does the President have the power to impose sanctions on foreign individuals and entities engaged in significant malicious cyber activities?
- International Emergency Economic Powers Act (IEEPA) and Executive Order 13694 (Correct answer)
- Computer Fraud and Abuse Act
- Classified Information Procedures Act
- National Cybersecurity Protection Act
Correct answer: International Emergency Economic Powers Act (IEEPA) and Executive Order 13694
EO 13694 (amended by EO 13757) uses IEEPA authority to allow Treasury/OFAC to designate and sanction those responsible for significant malicious cyber-enabled activities.
Question 6: Which law requires the federal government to disclose vulnerabilities it discovers in commercial products through a formal equities review process?
- The Vulnerabilities Equities Policy (VEP) (Correct answer)
- FISMA Section 3554
- Executive Order 14028
- The Cybersecurity Information Sharing Act
Correct answer: The Vulnerabilities Equities Policy (VEP)
The Vulnerabilities Equities Policy (codified in EO policy since 2017) establishes an interagency process for deciding whether to disclose or retain discovered vulnerabilities for intelligence purposes.
CSL CSL Government & Critical Infrastructure Security Law 2
The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards are mandatory for electric utilities.
Which federal agency enforces these standards?