Risk Management & Compliance Flashcards

Under HIPAA's Breach Notification Rule, covered entities must notify affected individuals of an unsecured PHI breach within how many days of discovery?

Answer: 60 days

HIPAA requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI.

A senior specialist is performing a risk assessment and identifies a threat with a likelihood of 'High' and an impact of 'Low.' According to standard risk matrix methodology, how should this risk be categorized?

Answer: Medium

On a standard 3×3 or 5×5 risk matrix, High likelihood × Low impact typically yields a Medium risk rating.

Which federal law requires financial institutions to establish programs for customer identification and verification to prevent money laundering?

Answer: Bank Secrecy Act

The Bank Secrecy Act (BSA) and its Customer Identification Program (CIP) rules require financial institutions to verify customer identities to combat money laundering.

In the NIST Cybersecurity Framework, which function focuses on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Answer: Protect

The 'Protect' function in the NIST CSF encompasses safeguards such as access control, training, data security, and maintenance to limit the impact of a cybersecurity event.

A company's board of directors establishes the organization's risk appetite. Which document formally communicates acceptable risk levels to the entire organization?

Answer: Risk Appetite Statement

A Risk Appetite Statement formally articulates the types and amount of risk the organization is willing to accept in pursuit of its objectives.

Under SOX Section 404, management must assess the effectiveness of internal controls over financial reporting. Who must attest to and report on management's assessment?

Answer: An independent registered public accounting firm

SOX Section 404(b) requires an independent registered public accounting firm to attest to and report on management's assessment of internal controls over financial reporting.

Which risk response strategy involves sharing risk with a third party, such as through insurance or outsourcing?

Answer: Risk transfer

Risk transfer shifts the financial or operational impact of a risk to another party, such as purchasing insurance or contracting with a vendor.