GRC Compliance Standards & Regulatory Requirements 4

Question 1

An organization storing sensitive data in AWS wants to achieve FedRAMP authorization. Which step must come FIRST in the formal authorization process?

Accepted Answer

Complete a System Security Plan (SSP)

Answer

The FedRAMP authorization process begins with completing a System Security Plan (SSP) that documents all security controls implemented in the cloud system.

Question 2

Under NERC CIP standards, which standard addresses Physical Security of BES Cyber Systems?

Accepted Answer

NERC CIP-006

Answer

NERC CIP-006 establishes requirements for physical security plans to protect BES (Bulk Electric System) Cyber Systems from unauthorized physical access.

Question 3

Which element is NOT one of the three pillars of the EU-US Data Privacy Framework that replaced Privacy Shield?

Accepted Answer

Binding corporate rules for transfers

Answer

The EU-US Data Privacy Framework's three pillars address data protection obligations, redress mechanisms, and US government surveillance safeguards — not binding corporate rules.

Question 4

SOC 2 Type II reports differ from Type I reports primarily because Type II reports cover:

Accepted Answer

The design AND operating effectiveness of controls over a period of time

Answer

SOC 2 Type II reports evaluate both the design suitability and the operating effectiveness of controls over a minimum review period (typically 6–12 months).

Question 5

Under the Children's Online Privacy Protection Act (COPPA), parental consent is required before collecting personal information from children under what age?

Accepted Answer

13

Answer

COPPA requires verifiable parental consent before collecting, using, or disclosing personal information from children under 13 years of age.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Compliance Standards & Regulatory Requirements 4