DRI Regulatory Compliance & Standards 2

Question 1

The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities to have which business continuity element?

Accepted Answer

A contingency plan that includes data backup, disaster recovery, and emergency operations

Answer

HIPAA's Security Rule requires covered entities to implement a contingency plan that includes data backup procedures, disaster recovery procedures, emergency mode operation procedures, testing and revision procedures, and applications and data criticality analysis.

Question 2

Which international standard specifically addresses information security management and has direct relevance to IT disaster recovery planning?

Accepted Answer

ISO 27001

Answer

ISO 27001 is the international standard for information security management systems (ISMS). It includes requirements for business continuity planning specifically for information security, making it directly relevant to IT disaster recovery.

Question 3

The Sarbanes-Oxley Act (SOX) Section 404 is primarily relevant to business continuity because it requires:

Accepted Answer

Management assessment of internal controls over financial reporting, including controls supporting system availability

Answer

SOX Section 404 requires management to assess and report on internal controls over financial reporting, which includes IT general controls such as system availability, backup, and recovery—core business continuity elements.

Question 4

Under GDPR, what must an organization do when a personal data breach affecting individuals' rights occurs?

Accepted Answer

Notify the supervisory authority within 72 hours of becoming aware of the breach

Answer

GDPR Article 33 requires organizations to notify the relevant supervisory authority (data protection regulator) within 72 hours of becoming aware of a personal data breach, where feasible.

Question 5

The NIST Cybersecurity Framework (CSF) function 'Recover' directly supports business continuity by focusing on:

Accepted Answer

Developing and implementing restoration activities after a cybersecurity incident

Answer

The NIST CSF 'Recover' function focuses on developing and implementing appropriate activities to maintain plans for resilience and restore capabilities or services impaired by a cybersecurity incident—directly supporting business continuity objectives.

(DRI) Disaster Recovery Institute International Certification Practice Test

(DRI) Disaster Recovery Institute International Certification Practice Test

DRI Regulatory Compliance & Standards 2