GRC Compliance Standards & Regulatory Requirements 2

Question 1

Which regulation requires covered entities and business associates to implement safeguards for protected health information (PHI)?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule mandates administrative, physical, and technical safeguards to protect electronic PHI for covered entities and their business associates.

Question 2

Under PCI DSS, what is the maximum number of days allowed to patch critical vulnerabilities in systems that process cardholder data?

Accepted Answer

30 days

Answer

PCI DSS Requirement 6.3.3 requires critical patches to be installed within one month (30 days) of release to protect cardholder data environments.

Question 3

Which NIST publication provides a framework for managing cybersecurity risk using five core functions: Identify, Protect, Detect, Respond, and Recover?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions to help organizations manage and reduce cyber risk.

Question 4

GDPR Article 83 establishes maximum fines of up to €20 million or what percentage of global annual turnover for the most serious violations?

Accepted Answer

4%

Answer

GDPR's highest tier of fines can reach €20 million or 4% of the organization's total global annual turnover, whichever is higher.

Question 5

ISO/IEC 27001:2022 replaced which previous version of the standard?

Accepted Answer

ISO/IEC 27001:2013

Answer

ISO/IEC 27001:2022 replaced the 2013 version, introducing restructured Annex A controls and alignment with ISO Annex SL harmonized structure.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Compliance Standards & Regulatory Requirements 2