CSPM Risk Management & Compliance Flashcards

In the CSPM framework, which risk management step involves identifying potential threats and their likelihood of occurrence?

Answer: Risk identification

Risk identification is the foundational step where potential threats, vulnerabilities, and their likelihood are catalogued before any response strategy is chosen.

A security project manager is calculating the Annual Loss Expectancy (ALE) for a threat. Which formula is correct?

Answer: ALE = SLE × ARO

ALE equals Single Loss Expectancy (SLE) multiplied by Annual Rate of Occurrence (ARO), expressing the expected yearly financial loss from a specific threat.

Which US federal regulation requires organizations handling electronic protected health information (ePHI) to conduct regular risk analyses?

Answer: HIPAA Security Rule

The HIPAA Security Rule mandates covered entities and business associates to perform regular risk analyses to identify threats to ePHI confidentiality, integrity, and availability.

What type of risk response strategy involves purchasing cyber insurance to offset potential financial losses?

Answer: Risk transfer

Risk transfer shifts the financial burden of a risk to a third party, such as an insurer, rather than eliminating or reducing the underlying threat.

In a CSPM context, a residual risk is best described as:

Answer: The risk remaining after security controls have been implemented

Residual risk is the level of risk that persists after all planned security controls and mitigations have been put into place.

Which compliance framework is most directly applicable to US federal government information systems security management?

Answer: NIST RMF

The NIST Risk Management Framework (RMF) is the mandated standard for US federal agencies to categorize, select, implement, assess, authorize, and monitor security controls.