Risk Management & Compliance Flashcards

The EU General Data Protection Regulation (GDPR) requires organizations to report a personal data breach to the relevant supervisory authority within what timeframe?

Answer: 72 hours

GDPR Article 33 mandates that controllers notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, where feasible.

A senior specialist implements data masking on production database exports used for testing. This control is BEST described as which type?

Answer: Preventive control

Data masking is a preventive control because it proactively reduces exposure of sensitive data before unauthorized access can occur.

Which compliance framework is specifically designed for payment card data security and applies to all entities that store, process, or transmit cardholder data?

Answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security requirements for any organization involved in payment card processing.

In enterprise risk management, 'inherent risk' is BEST defined as:

Answer: Risk existing before any controls are implemented

Inherent risk is the level of risk present in the absence of any controls or mitigation measures.

A healthcare organization must conduct a Security Risk Analysis under which federal regulation?

Answer: HIPAA Security Rule

The HIPAA Security Rule (45 CFR § 164.308(a)(1)) requires covered entities and business associates to conduct an accurate and thorough Security Risk Analysis.

When a senior specialist performs a third-party vendor risk assessment, which document is MOST important to review for understanding the vendor's security posture?

Answer: SOC 2 Type II report

A SOC 2 Type II report provides an independent auditor's assessment of a vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time.

The concept of 'defense in depth' in risk management refers to:

Answer: Implementing multiple layers of controls so that if one fails, others remain effective

Defense in depth employs multiple overlapping security controls so that the failure of any single control does not result in a complete security compromise.