Compliance & Risk Management Flashcards

Under the NIST Risk Management Framework (RMF), which step involves continuously tracking security controls over time?

Answer: Monitor

The Monitor step in the NIST RMF involves ongoing assessment of security controls to detect changes that may affect risk posture.

A company discovers that a third-party vendor has been improperly handling customer PII. Under a risk management framework, this is best classified as:

Answer: Third-party/supply chain risk

Risks arising from vendor or supplier relationships are classified as third-party or supply chain risk in standard risk frameworks.

Which compliance framework is specifically designed to protect cardholder data for organizations that process credit card transactions?

Answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any organization that stores, processes, or transmits cardholder data.

In risk management, the term 'residual risk' refers to:

Answer: Risk remaining after controls have been applied

Residual risk is the level of risk that remains after risk treatment or controls have been implemented.

The Sarbanes-Oxley Act (SOX) Section 302 primarily requires:

Answer: CEO and CFO certification of financial statement accuracy

SOX Section 302 requires senior executives to personally certify the accuracy and completeness of corporate financial reports.

When performing a gap analysis for compliance, an organization is primarily trying to:

Answer: Compare current state against required compliance standards

A gap analysis compares an organization's current compliance posture to what is required by a standard or regulation to identify deficiencies.

Which type of risk treatment involves purchasing cyber liability insurance?

Answer: Risk transfer

Purchasing insurance shifts the financial consequence of a risk to a third party, which is the definition of risk transfer.