Governance, Risk & Compliance Flashcards

A company purchases cyber insurance to offset potential financial losses from a data breach. Which risk response strategy does this represent?

Answer: Risk transfer

Risk transfer shifts the financial burden of a risk to a third party, such as through purchasing cyber insurance.

An organization labels its most sensitive data as 'Confidential' and its public-facing data as 'Public.' What security concept is being applied?

Answer: Data classification

Data classification categorizes data based on its sensitivity level so that appropriate security controls can be applied.

Which regulation requires organizations processing EU citizens' personal data to notify authorities of a breach within 72 hours and obtain explicit consent before collection?

Answer: GDPR

GDPR (General Data Protection Regulation) mandates 72-hour breach notification and explicit consent for processing EU citizens' personal data.

During a Business Impact Analysis, which metric defines the maximum length of time a critical business function can be unavailable before causing unacceptable harm to the organization?

Answer: Maximum Tolerable Downtime (MTD)

Maximum Tolerable Downtime (MTD) defines the absolute outer limit of downtime before the impact becomes unacceptable to the business.

A company's payroll system can tolerate losing no more than 4 hours of transaction data in the event of a disaster. Which metric does this describe?

Answer: Recovery Point Objective (RPO)

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate.

Which function of the NIST Cybersecurity Framework focuses on developing organizational understanding of cybersecurity risks to systems, assets, and data?

Answer: Identify

The NIST CSF 'Identify' function helps organizations understand their cybersecurity risk environment, including assets, data, and current governance practices.

Which security policy document defines the rules employees must follow when using company-owned computers, networks, and internet access?

Answer: Acceptable Use Policy (AUP)

An Acceptable Use Policy (AUP) outlines permitted and prohibited uses of organizational IT resources to govern employee behavior.