Regulatory and Legal Compliance ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A retail company is required to report compliance status to its board of directors quarterly. The CISO wants to provide meaningful updates without overwhelming the board. Which approach best meets this requirement?

   • ADelegate reporting to the external auditor
   • BSend the full text of all applicable laws and regulations
   • CProvide a dashboard with key risk indicators and compliance metrics
   • DReport only when a compliance breach occurs
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which regulatory framework is primarily focused on protecting the confidentiality, integrity, and availability of cardholder data for organizations that handle payment card transactions?

   • AGeneral Data Protection Regulation (GDPR)
   • BHealth Insurance Portability and Accountability Act (HIPAA)
   • CFederal Information Security Management Act (FISMA)
   • DPayment Card Industry Data Security Standard (PCI DSS)
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is facing a regulatory investigation for a data breach. The investigation reveals that the company had a compliance program, but it was not fully implemented. The CISO must determine the potential impact. Which factor is most likely to influence the severity of the penalty?

   • AThe company's stock price at the time of the breach.
   • BThe number of employees in the company.
   • CThe company's marketing budget.
   • DThe degree to which the company had implemented the compliance program and the steps taken to mitigate the breach.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is a service provider for multiple healthcare clients. It stores ePHI on behalf of these clients. The company wants to ensure it meets HIPAA requirements. What is the most critical action?

   • ASign Business Associate Agreements (BAAs) with each healthcare client
   • BObtain ISO 27001 certification
   • CConduct annual penetration testing
   • DEncrypt all ePHI at rest and in transit
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A cloud service provider that processes credit card transactions wants to demonstrate compliance with the payment card industry's security requirements to its merchants. Which framework should the provider implement and certify against?

   • ANIST CSF, because it is a legal requirement for all US-based cloud providers.
   • BISO/IEC 27001, because it is the only standard that covers all aspects of information security.
   • CPCI DSS, because it is the mandatory security standard for entities that store, process, or transmit cardholder data.
   • DSOC 2, because it is a regulatory framework that mandates security controls for all cloud providers.
   Reveal Solution Discussion Select an answer first