RPA Security and Governance Flashcards

What is 'bot sprawl' and why is it a governance concern?

Answer: Uncontrolled proliferation of bots without proper oversight, documentation, or maintenance

Bot sprawl occurs when bots are created without governance controls, leading to an unmanageable inventory of undocumented, unmaintained, or redundant automations.

What is the purpose of an 'audit trail' in RPA?

Answer: Providing a detailed, tamper-evident log of all bot actions for compliance and forensic review

An audit trail creates an immutable record of what each bot did, when, and to what data — essential for compliance, investigations, and demonstrating regulatory adherence.

What does 'least privilege' mean as applied to RPA bot accounts?

Answer: Bots should only be granted the minimum access rights needed to perform their specific tasks

The least privilege principle limits bot access rights to only what is required for its specific tasks, reducing the attack surface if the bot account is compromised.

What is 'change control' in the context of RPA bot management?

Answer: A formal process for reviewing, approving, and documenting changes to bot workflows before deployment

Change control ensures all bot updates go through a structured review and approval process to prevent unauthorized or untested changes from reaching production.

Which regulation most directly impacts how RPA bots handle personal data in the US healthcare sector?

Answer: HIPAA (Health Insurance Portability and Accountability Act)

HIPAA governs the privacy and security of protected health information (PHI) in the US — RPA bots processing healthcare data must comply with its requirements.

What is 'incident management' for RPA bots concerned with?

Answer: Detecting, reporting, investigating, and resolving bot failures and security incidents

Incident management for RPA covers the processes for identifying when a bot fails or behaves unexpectedly, triaging the issue, and restoring normal operation.