Regulatory Compliance & Standards Flashcards

Which regulatory framework requires financial institutions to maintain comprehensive business continuity plans and conduct regular testing of those plans?

Answer: FFIEC Business Continuity Management booklet guidance

The Federal Financial Institutions Examination Council (FFIEC) Business Continuity Management booklet provides comprehensive guidance for financial institutions on developing, maintaining, and testing business continuity programs.

ISO 22301 certification requires an organization to demonstrate which of the following?

Answer: A documented and implemented BCMS that meets the standard's requirements, verified through internal and external audits

ISO 22301 certification requires an organization to demonstrate through documented evidence and audit that their Business Continuity Management System (BCMS) conforms to the standard's requirements—not zero downtime or government endorsement.

What does 'due diligence' mean in the context of regulatory compliance for business continuity?

Answer: Taking reasonable steps to ensure compliance with applicable laws and implementing appropriate continuity controls

Due diligence in business continuity compliance means taking reasonable, documented steps to understand applicable requirements and implementing appropriate controls—demonstrating that the organization exercised proper care in meeting its obligations.

A state law requires a utility company to restore service to 90% of affected customers within 72 hours of a major storm. This type of regulatory requirement is best described as a:

Answer: Recovery Time Objective (RTO)

This 72-hour restoration requirement is a regulatory RTO—it specifies the maximum time allowed to restore service to a defined percentage of customers, which is functionally equivalent to a Recovery Time Objective imposed by regulation rather than internal business decision.

When a business continuity professional says a plan is 'compliant,' this MOST accurately means the plan:

Answer: Addresses all applicable regulatory and standards requirements relevant to the organization

Compliance means the plan addresses all applicable regulatory requirements, legal obligations, and relevant standards—not that it has been board-approved, never failed, or was written by a certified professional.

Which of the following scenarios represents a violation of the principle of 'regulatory horizon scanning' in business continuity?

Answer: Updating the compliance matrix only after a regulatory audit finds gaps

Updating the compliance matrix only after a regulatory audit finds gaps is reactive rather than proactive, violating the principle of regulatory horizon scanning, which requires monitoring the regulatory environment continuously to anticipate and prepare for changes.