Regulations, Standards, and Compliance Flashcards

Which international standard specifically addresses supply chain continuity and provides requirements for business continuity within the context of supply chain resilience?

Answer: ISO 28000

ISO 28000 specifies requirements for a security management system for the supply chain, including business continuity elements relevant to supply chain disruptions.

A company subject to the EU's Digital Operational Resilience Act (DORA) is classified as a financial entity. DORA's ICT-related incident reporting requirement mandates initial notification to the competent authority within:

Answer: 4 hours of classification as a major incident

DORA Article 19 requires financial entities to submit an initial notification to the competent authority within 4 hours from the classification of an event as a major ICT-related incident, and no later than 24 hours from detection.

The principle of 'accountability' in ISO 22301 auditing requires that:

Answer: The organization can demonstrate evidence that BCMS requirements are being met

ISO 22301's accountability principle means the organization must retain documented information (evidence) to demonstrate conformity with BCMS requirements, enabling verification during audits.

When a U.S. healthcare organization's DR site is located outside the United States, which compliance consideration is MOST critical regarding patient data replicated to that site?

Answer: The DR site must comply with HIPAA requirements regardless of location, and a BAA may be required

HIPAA's requirements follow ePHI regardless of where it is stored; covered entities must ensure offshore DR sites implement required safeguards and business associate agreements (BAAs) must be in place with offshore vendors.

The FFIEC's 'Two-Hour Recovery Time Objective' guidance primarily applies to:

Answer: Clearing and settlement systems critical to the financial sector's core functions

The FFIEC and interagency guidance established a 2-hour RTO for critical clearing and settlement systems to prevent systemic risk to the broader financial sector in the event of a wide-scale disruption.

An organization's BC auditor notes that corrective actions from the previous audit cycle were not fully implemented before the surveillance audit. Under ISO 22301, this situation most likely constitutes:

Answer: A major nonconformity because failure to address prior findings demonstrates BCMS breakdown

Persistent failure to implement corrective actions demonstrates a systemic breakdown in the continual improvement and corrective action processes (Clause 10), which is a major nonconformity affecting the BCMS integrity.

Which provision of the Gramm-Leach-Bliley Act (GLBA) most directly requires financial institutions to implement BC/DR safeguards for customer financial information?

Answer: The Safeguards Rule

The GLBA Safeguards Rule (16 CFR Part 314) requires financial institutions to implement a comprehensive information security program including safeguards for the security and integrity of customer financial information, which encompasses availability and recovery controls.