Regulations, Standards, and Compliance Flashcards

Which NIST publication provides the primary framework for federal agency information security programs, including contingency planning requirements?

Answer: NIST SP 800-53

NIST SP 800-53 provides the catalog of security and privacy controls for federal information systems, including contingency planning (CP) control family requirements.

Under HIPAA's Security Rule, covered entities are required to implement a contingency plan that includes all of the following EXCEPT:

Answer: Business continuity plan

HIPAA's Security Rule requires a data backup plan, disaster recovery plan, emergency mode operation plan, testing and revision procedures, and applications and data criticality analysis — a standalone 'business continuity plan' is not listed as a required addressable or required implementation specification.

The Sarbanes-Oxley Act (SOX) Section 404 primarily impacts BC/DR programs because it requires:

Answer: Management assessment and auditor attestation of internal controls over financial reporting

SOX Section 404 requires management to assess and external auditors to attest to the effectiveness of internal controls over financial reporting, which directly implicates IT availability and recovery capabilities.

ISO 22301:2019 replaced which predecessor standard for business continuity management systems?

Answer: BS 25999-2

BS 25999-2 was the British Standard for BCMS that ISO 22301 replaced and internationalized when first published in 2012 and subsequently updated in 2019.

Which regulatory body oversees business continuity and operational resilience requirements for U.S. federally insured depository institutions?

Answer: FDIC

The FDIC, along with the OCC and Federal Reserve, issues guidance on business continuity planning for federally insured depository institutions through the FFIEC IT Examination Handbook.

The FFIEC Business Continuity Management booklet recommends that financial institutions define recovery time objectives based primarily on:

Answer: Results of the business impact analysis

FFIEC guidance directs institutions to derive RTOs from the business impact analysis, which identifies time-sensitivity of processes and the maximum tolerable downtime for critical functions.

Under GDPR, if a data breach affects personal data availability (e.g., ransomware destroying backups), the controller must notify the supervisory authority within:

Answer: 72 hours

GDPR Article 33 requires controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it.