Risk Management & Compliance Flashcards

What is the primary goal of risk management in information security?

Answer: To reduce risks to an acceptable level.

The primary goal of risk management in information security is not to eliminate all risks, as achieving 100% security is often impractical or impossible. Instead, it aims to identify, assess, and implement controls to reduce risks to a level that is acceptable to the organization, balancing security with operational needs and cost. This approach ensures that critical assets are protected without hindering business functions.

Which framework is widely used for managing cybersecurity risk?

Answer: NIST CSF (Cybersecurity Framework)

The NIST Cybersecurity Framework (CSF) is a widely adopted, voluntary framework that provides a common language and systematic approach for organizations to manage and reduce cybersecurity risk. It consists of five core functions: Identify, Protect, Detect, Respond, and Recover. While other options are relevant to security or quality, NIST CSF is specifically designed for comprehensive cybersecurity risk management.

What is the purpose of a Risk Assessment?

Answer: To identify and evaluate potential risks.

A Risk Assessment is a systematic process used to identify potential threats and vulnerabilities that could impact an organization's assets. Its purpose is to evaluate the likelihood and impact of these risks, providing a clear understanding of the organization's risk posture. This evaluation then informs decisions on which security controls are necessary to mitigate identified risks effectively.

Which regulation mandates the protection of personal data in the European Union?

Answer: GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data privacy and security law enacted by the European Union. It mandates strict rules for how organizations collect, process, and store personal data of individuals within the EU, granting individuals greater control over their data. This regulation aims to protect personal data from breaches and misuse, ensuring privacy rights across member states.

What is the role of a Data Protection Officer (DPO)?

Answer: To oversee data protection strategies and compliance.

A Data Protection Officer (DPO) is a key role mandated by regulations like GDPR, responsible for overseeing an organization's data protection strategy and ensuring compliance with data protection laws. The DPO acts as an independent advisor, monitoring internal compliance, informing and advising on data protection obligations, and serving as a contact point for supervisory authorities and data subjects.

Which of the following is a common risk treatment strategy?

Answer: Implementing security controls to mitigate the risk.

Risk treatment involves deciding how to handle identified risks. Implementing security controls to mitigate the risk is a common and proactive strategy, aiming to reduce the likelihood or impact of a risk event. This could involve technical controls like firewalls or encryption, or administrative controls like policies and training, thereby reducing the overall risk exposure.

What does PCI DSS stand for?

Answer: Payment Card Industry Data Security Standard

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security standards designed to ensure that all companies that process, store, or transmit credit card information maintain a secure environment. Compliance with PCI DSS is mandatory for organizations handling payment card data to protect cardholder information from theft and fraud, thereby safeguarding financial transactions.

Which document defines an organization's approach to risk management?

Answer: Risk Management Framework (RMF)

A Risk Management Framework (RMF) is a structured approach that defines an organization's strategy for managing cybersecurity and privacy risks. It provides a systematic process for identifying, assessing, responding to, and monitoring risks, ensuring that security controls are implemented effectively and continuously managed. This framework guides an organization's overall risk posture and decision-making, aligning security efforts with business objectives.

What is residual risk?

Answer: Risk that remains after mitigation efforts.

Residual risk is the level of risk that remains after an organization has implemented all planned security controls and mitigation strategies. It is the risk that management has accepted, understanding that it cannot be entirely eliminated or that the cost of further mitigation outweighs the potential benefits. Organizations aim to reduce risks to an acceptable residual level, balancing security with operational realities.