CSM Regulatory Compliance & Governance 3 — Questions and Answers
Question 1: Which ISO standard provides a framework specifically for information security management systems (ISMS)?
- ISO 9001
- ISO 27001 (Correct answer)
- ISO 31000
- ISO 20000
Correct answer: ISO 27001
ISO/IEC 27001 is the international standard for establishing, implementing, maintaining, and continually improving an ISMS.
Question 2: Under the California Consumer Privacy Act (CCPA), which right allows consumers to request that a business stop selling their personal information?
- Right to Know
- Right to Delete
- Right to Opt-Out (Correct answer)
- Right to Non-Discrimination
Correct answer: Right to Opt-Out
The Right to Opt-Out under CCPA (Section 1798.120) allows consumers to direct businesses to stop selling their personal information.
Question 3: A software manager must ensure audit trails are tamper-evident. Which technical control best supports this governance requirement?
- Role-based access control on log files
- Cryptographic hashing and write-once log storage (Correct answer)
- Daily manual review of log files
- Compressing logs to reduce storage footprint
Correct answer: Cryptographic hashing and write-once log storage
Cryptographic hashing combined with write-once (WORM) storage makes audit logs tamper-evident by detecting any unauthorized modification.
Question 4: In a software governance context, what does 'separation of duties' primarily prevent?
- Unauthorized access to network resources
- Single individuals from having unchecked control over critical processes (Correct answer)
- Data leakage through insecure APIs
- Software license non-compliance
Correct answer: Single individuals from having unchecked control over critical processes
Separation of duties (SoD) ensures no single person can control all aspects of a critical process, reducing fraud and error risk.
Question 5: Which regulatory framework is mandatory for U.S. federal information systems and establishes minimum security requirements based on system impact levels?
- PCI DSS
- FISMA/NIST SP 800-53 (Correct answer)
- SOC 2 Type II
- HITRUST CSF
Correct answer: FISMA/NIST SP 800-53
FISMA (Federal Information Security Modernization Act) mandates compliance with NIST SP 800-53 security controls for all U.S. federal information systems.
Question 6: During a software procurement review, a manager finds a vendor's product collects telemetry data and sends it to servers in a non-EU country. Under GDPR, which mechanism can lawfully authorize this transfer?
- A bilateral NDA between the two companies
- Standard Contractual Clauses (SCCs) approved by the European Commission (Correct answer)
- The vendor's published privacy policy
- An end-user license agreement signed by employees
Correct answer: Standard Contractual Clauses (SCCs) approved by the European Commission
Standard Contractual Clauses (SCCs) are an approved GDPR transfer mechanism for moving personal data to third countries without an adequacy decision.
Question 7: A compliance audit finds that software developers have direct write access to the production database. Which governance principle is most clearly violated?
- Least privilege (Correct answer)
- Defense in depth
- Non-repudiation
- Data minimization
Correct answer: Least privilege
The principle of least privilege requires users to have only the minimum access necessary for their role; developers typically should not have write access to production.
CSM Regulatory Compliance & Governance 3
Which ISO standard provides a framework specifically for information security management systems (ISMS)?