CSS Risk Management & Compliance 2

Question 1

Under HIPAA's Breach Notification Rule, covered entities must notify affected individuals of an unsecured PHI breach within how many days of discovery?

Accepted Answer

60 days

Answer

HIPAA requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI.

Question 2

A senior specialist is performing a risk assessment and identifies a threat with a likelihood of 'High' and an impact of 'Low.' According to standard risk matrix methodology, how should this risk be categorized?

Accepted Answer

Medium

Answer

On a standard 3×3 or 5×5 risk matrix, High likelihood × Low impact typically yields a Medium risk rating.

Question 3

Which federal law requires financial institutions to establish programs for customer identification and verification to prevent money laundering?

Accepted Answer

Bank Secrecy Act

Answer

The Bank Secrecy Act (BSA) and its Customer Identification Program (CIP) rules require financial institutions to verify customer identities to combat money laundering.

Question 4

In the NIST Cybersecurity Framework, which function focuses on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect

Answer

The 'Protect' function in the NIST CSF encompasses safeguards such as access control, training, data security, and maintenance to limit the impact of a cybersecurity event.

Question 5

A company's board of directors establishes the organization's risk appetite. Which document formally communicates acceptable risk levels to the entire organization?

Accepted Answer

Risk Appetite Statement

Answer

A Risk Appetite Statement formally articulates the types and amount of risk the organization is willing to accept in pursuit of its objectives.

(CSS) Certified Senior Specialist Practice Test

(CSS) Certified Senior Specialist Practice Test

CSS Risk Management & Compliance 2