Regulatory Compliance & Standards Flashcards

Which Common Criteria element describes the level of confidence in a product's security evaluation?

Answer: Evaluation Assurance Level

Evaluation Assurance Levels (EAL1–EAL7) indicate the depth and rigor of assurance for evaluated products.

Which standard validates cryptographic modules for U.S. federal use?

Answer: FIPS 140

FIPS 140 specifies security requirements for cryptographic modules validated through CMVP.

In the NIST Risk Management Framework, what step follows selecting controls?

Answer: Implement controls

RMF steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.

A U.S. company has EU customers but no EU office. When does GDPR still apply to it?

Answer: When it offers goods or services to or monitors individuals in the EU

GDPR has extraterritorial scope when targeting or monitoring individuals in the EU.

Which best describes the purpose of the CIS Critical Security Controls?

Answer: Prioritized actions to defend against common attacks

CIS Controls provide prioritized, actionable safeguards against common cyberattacks.

Which sanction can GDPR impose for the most serious infringements?

Answer: Up to 20 million euros or 4% of global annual turnover, whichever higher

Higher-tier GDPR fines reach 20 million euros or 4% of worldwide annual turnover.

What should a security manager do first when a new regulation may affect the organization?

Answer: Perform a gap analysis against current controls

A gap analysis identifies differences between current controls and new requirements to plan remediation.