DRI Regulations, Standards, and Compliance 2

Question 1

Which NIST publication provides the primary framework for federal agency information security programs, including contingency planning requirements?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the catalog of security and privacy controls for federal information systems, including contingency planning (CP) control family requirements.

Question 2

Under HIPAA's Security Rule, covered entities are required to implement a contingency plan that includes all of the following EXCEPT:

Accepted Answer

Business continuity plan

Answer

HIPAA's Security Rule requires a data backup plan, disaster recovery plan, emergency mode operation plan, testing and revision procedures, and applications and data criticality analysis — a standalone 'business continuity plan' is not listed as a required addressable or required implementation specification.

Question 3

The Sarbanes-Oxley Act (SOX) Section 404 primarily impacts BC/DR programs because it requires:

Accepted Answer

Management assessment and auditor attestation of internal controls over financial reporting

Answer

SOX Section 404 requires management to assess and external auditors to attest to the effectiveness of internal controls over financial reporting, which directly implicates IT availability and recovery capabilities.

Question 4

ISO 22301:2019 replaced which predecessor standard for business continuity management systems?

Accepted Answer

BS 25999-2

Answer

BS 25999-2 was the British Standard for BCMS that ISO 22301 replaced and internationalized when first published in 2012 and subsequently updated in 2019.

Question 5

Which regulatory body oversees business continuity and operational resilience requirements for U.S. federally insured depository institutions?

Accepted Answer

FDIC

Answer

The FDIC, along with the OCC and Federal Reserve, issues guidance on business continuity planning for federally insured depository institutions through the FFIEC IT Examination Handbook.

(DRI) Disaster Recovery Institute International Certification Practice Test

(DRI) Disaster Recovery Institute International Certification Practice Test

DRI Regulations, Standards, and Compliance 2