CSM Regulatory Compliance & Governance 2

Question 1

Under the Sarbanes-Oxley Act (SOX), which section specifically requires management to assess and report on the effectiveness of internal controls over financial reporting?

Accepted Answer

Section 404

Answer

SOX Section 404 requires management to assess and report on the effectiveness of internal controls over financial reporting annually.

Question 2

A software manager discovers that a third-party vendor has access to customer PII but has not signed a Data Processing Agreement (DPA). Under GDPR, what is the immediate required action?

Accepted Answer

Execute a DPA before any further data processing

Answer

GDPR Article 28 requires a written DPA to be in place before a processor can lawfully handle personal data on behalf of a controller.

Question 3

In IT governance frameworks, which COBIT 5 domain is primarily responsible for ensuring that IT services are delivered effectively and efficiently?

Accepted Answer

Deliver, Service and Support (DSS)

Answer

The DSS (Deliver, Service and Support) domain in COBIT 5 focuses on the delivery of IT services and support operations.

Question 4

Which U.S. federal law primarily governs the privacy and security of protected health information (PHI) in software systems used by healthcare providers?

Accepted Answer

HIPAA

Answer

HIPAA (Health Insurance Portability and Accountability Act) establishes national standards for protecting PHI in healthcare-related software and systems.

Question 5

A software manager is conducting a risk assessment for compliance purposes. Which approach best aligns with the NIST Risk Management Framework (RMF)?

Accepted Answer

Categorize systems, select controls, implement, assess, authorize, and monitor continuously

Answer

The NIST RMF follows a six-step process: Categorize, Select, Implement, Assess, Authorize, and Monitor.

(CSM) Certified Software Manager Practice Test

(CSM) Certified Software Manager Practice Test

CSM Regulatory Compliance & Governance 2