Security Auditing & Compliance Standards Flashcards

Which audit type is performed without prior notice to the auditee to capture the true state of security controls?

Answer: Unannounced audit

Unannounced audits capture the genuine state of controls because staff cannot prepare or temporarily implement missing safeguards.

Under HIPAA Security Rule, which of the following is a required implementation specification?

Answer: Audit controls

Audit controls is a required specification under the Technical Safeguards section of the HIPAA Security Rule, while encryption is addressable.

A SOC 2 Type II report differs from a SOC 2 Type I report primarily because it:

Answer: Evaluates control design and operating effectiveness over a period of time

SOC 2 Type II assesses both the design and operating effectiveness of controls over a defined review period, not just their design at a point in time.

Which PCI DSS requirement mandates that cardholder data environments use unique IDs for each person with computer access?

Answer: Requirement 8

PCI DSS Requirement 8 requires that all users be assigned a unique ID to ensure accountability and traceability of actions.

Which term describes the practice of comparing an organization's security controls against an established baseline or best-practice framework?

Answer: Gap analysis

A gap analysis identifies differences between the current state of controls and the desired baseline or framework requirements.

The NIST Cybersecurity Framework's 'Identify' function primarily focuses on:

Answer: Developing organizational understanding of cybersecurity risk

The Identify function helps organizations develop understanding of their assets, risks, and governance to manage cybersecurity risk.

An auditor discovers that access rights have not been reviewed in 18 months. Which audit finding category best describes this?

Answer: Major nonconformity

A major nonconformity indicates a systematic failure or absence of a required control, such as a completely missing access review process.