Practice Test Geeks(DRI) Disaster Recovery Institute International Certification Practice Test
← All DRI Flashcard Decks

Regulatory Compliance & Standards Flashcards

6 cards from real DRI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Regulatory Compliance & Standards flashcards as text

  1. The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities to have which business continuity element?

    Answer: A contingency plan that includes data backup, disaster recovery, and emergency operations

    HIPAA's Security Rule requires covered entities to implement a contingency plan that includes data backup procedures, disaster recovery procedures, emergency mode operation procedures, testing and revision procedures, and applications and data criticality analysis.

  2. Which international standard specifically addresses information security management and has direct relevance to IT disaster recovery planning?

    Answer: ISO 27001

    ISO 27001 is the international standard for information security management systems (ISMS). It includes requirements for business continuity planning specifically for information security, making it directly relevant to IT disaster recovery.

  3. The Sarbanes-Oxley Act (SOX) Section 404 is primarily relevant to business continuity because it requires:

    Answer: Management assessment of internal controls over financial reporting, including controls supporting system availability

    SOX Section 404 requires management to assess and report on internal controls over financial reporting, which includes IT general controls such as system availability, backup, and recovery—core business continuity elements.

  4. Under GDPR, what must an organization do when a personal data breach affecting individuals' rights occurs?

    Answer: Notify the supervisory authority within 72 hours of becoming aware of the breach

    GDPR Article 33 requires organizations to notify the relevant supervisory authority (data protection regulator) within 72 hours of becoming aware of a personal data breach, where feasible.

  5. The NIST Cybersecurity Framework (CSF) function 'Recover' directly supports business continuity by focusing on:

    Answer: Developing and implementing restoration activities after a cybersecurity incident

    The NIST CSF 'Recover' function focuses on developing and implementing appropriate activities to maintain plans for resilience and restore capabilities or services impaired by a cybersecurity incident—directly supporting business continuity objectives.

  6. In a business continuity context, what is the primary purpose of a regulatory compliance matrix?

    Answer: To map specific regulatory requirements to business continuity program elements and identify gaps

    A regulatory compliance matrix maps specific regulatory and legal requirements to corresponding elements of the business continuity program, helping organizations identify coverage gaps and ensure all obligations are addressed.