Regulations, Standards, and Compliance Flashcards
7 cards from real DRI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulations, Standards, and Compliance flashcards as text
The NFPA 1600 standard is significant to business continuity professionals primarily because:
Answer: It is referenced by the 9/11 Commission as a voluntary consensus standard for disaster management
NFPA 1600 was endorsed by the 9/11 Commission as a voluntary national preparedness standard; it is widely referenced in legislation and provides a recognized framework for private sector preparedness.
Which of the following best describes the relationship between ISO 22301 and ISO 22313?
Answer: ISO 22301 specifies BCMS requirements for certification; ISO 22313 provides implementation guidance
ISO 22301 is the auditable requirements standard (using 'shall') against which organizations certify, while ISO 22313 is the companion guidance document (using 'should') that explains how to implement the requirements.
Under the Dodd-Frank Act, systemically important financial institutions (SIFIs) face enhanced BC/DR requirements primarily because:
Answer: Their failure or disruption could pose systemic risk to U.S. financial stability
Dodd-Frank designated certain institutions as SIFIs based on their size and interconnectedness, subjecting them to enhanced prudential standards including stricter operational resilience expectations due to their potential systemic impact.
A BC practitioner is preparing for an ISO 22301 Stage 1 audit. The MAIN purpose of the Stage 1 audit is to:
Answer: Review BCMS documentation and readiness for the Stage 2 audit
The ISO 22301 Stage 1 (document review) audit assesses the organization's BCMS documentation and determines whether the organization is sufficiently prepared for the Stage 2 on-site certification audit.
The SEC's Regulation Systems Compliance and Integrity (Reg SCI) requires covered entities to:
Answer: Establish, maintain, and enforce written policies for operational resilience of key market systems
Reg SCI requires covered SCI entities (exchanges, clearinghouses, etc.) to establish and enforce written policies and procedures reasonably designed to ensure operational capacity, resilience, and security of systems critical to market operations.
Which aspect of GDPR most directly creates a recovery time objective for organizations experiencing a ransomware attack that encrypts personal data?
Answer: 72-hour breach notification requirement (Article 33)
The 72-hour notification window under GDPR Article 33 creates an implicit time pressure to assess, contain, and begin notifying the supervisory authority, effectively driving an operational RTO for breach response.
FISMA requires federal agencies to develop, document, and implement an agency-wide information security program. Which of the following is the FISMA-required frequency for testing contingency plans for HIGH-impact systems?
Answer: Annually
NIST SP 800-53 CP-4 (referenced by FISMA) requires annual contingency plan testing and exercises for HIGH-impact federal information systems.