CSS CSS Compliance & Regulatory Frameworks

Question 1

Which US federal law mandates security controls for federal government information systems and requires FISMA compliance?

Accepted Answer

Federal Information Security Modernization Act (FISMA)

Answer

FISMA requires federal agencies to develop, document, and implement security programs for their information systems, using NIST standards as the framework.

Question 2

What does the NIST Cybersecurity Framework (CSF) core consist of?

Accepted Answer

Identify, Protect, Detect, Respond, Recover functions

Answer

The NIST CSF organizes security activities into five core functions: Identify, Protect, Detect, Respond, and Recover, providing a common language for managing cybersecurity risk.

Question 3

Which regulation governs the protection of personal health information (PHI) in the United States?

Accepted Answer

HIPAA (Health Insurance Portability and Accountability Act)

Answer

HIPAA's Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards for electronic PHI.

Question 4

What is the purpose of a System and Organization Controls (SOC 2) audit?

Accepted Answer

Evaluates a service organization's controls for security, availability, processing integrity, confidentiality, and privacy

Answer

SOC 2 reports assess whether a service provider's controls meet the AICPA Trust Service Criteria, particularly relevant for cloud and SaaS providers handling customer data.

Question 5

Which framework provides a comprehensive set of controls for information security management and is the basis for ISO/IEC 27001 certification?

Accepted Answer

ISO/IEC 27002 (Code of Practice for Information Security Controls)

Answer

ISO/IEC 27002 provides implementation guidance for the information security controls referenced in ISO/IEC 27001, the certifiable ISMS standard.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS CSS Compliance & Regulatory Frameworks