Regulations, Standards, and Compliance Flashcards

Which element is NOT a required component of an ISO 22301 BCMS policy statement?

Answer: Specific RTO and RPO targets for critical processes

ISO 22301 requires the BC policy to include commitments to requirements, continual improvement, and protection against disruptions, but specific RTO/RPO values belong in BIA and strategy documents, not the high-level policy.

The Payment Card Industry Data Security Standard (PCI DSS) Requirement 12.10 specifically addresses:

Answer: Incident response plan implementation and testing

PCI DSS Requirement 12.10 requires entities to implement an incident response plan and test it at least annually, ensuring readiness to respond to security events affecting cardholder data.

A BC manager discovers that a critical vendor's SLA does not align with the organization's RTO. Under ISO 22301, the MOST appropriate first action is:

Answer: Document the gap in the risk register and assess impact through the BIA

ISO 22301 requires organizations to evaluate and address risks from interested parties (including suppliers); documenting the gap and assessing its impact through the BIA ensures a risk-based, evidence-based response.

The Basel III framework influences BC/DR planning for banks primarily through its requirements for:

Answer: Operational risk capital adequacy and resilience standards

Basel III's Pillar 2 operational risk framework requires banks to hold adequate capital against operational risks, including those arising from disruptions, and to demonstrate robust operational resilience.

NIST SP 800-34 Rev. 1 defines the Continuity of Operations Plan (COOP) as distinct from a Disaster Recovery Plan primarily because:

Answer: COOP addresses continuity of essential government functions, while DRP focuses on IT system recovery

NIST SP 800-34 defines COOP as planning for continuity of an organization's essential functions during and after emergencies, whereas the DRP focuses specifically on recovering IT systems and infrastructure.

Which U.S. federal law requires continuity planning for critical infrastructure sectors and designates sector-specific agencies to coordinate resilience efforts?

Answer: Presidential Policy Directive 21 (PPD-21)

PPD-21 establishes national policy on critical infrastructure security and resilience, designates 16 critical infrastructure sectors, and assigns sector-specific agencies responsible for coordinating protective efforts.

When an organization certified to ISO 22301 undergoes a surveillance audit, the auditor finds that the organization has not tested its BC plan in 18 months. This would typically result in:

Answer: A major nonconformity finding requiring corrective action

Failure to exercise and test BC plans as required by ISO 22301 Clause 8.5 is a major nonconformity because it directly violates a mandatory shall requirement, triggering a corrective action process.