Regulatory and Legal Compliance ACCISO Practice Questions (Page 8)

Questions 36–37

1. 36expert · hard

   A company is preparing for a compliance assessment. It has identified that its data retention policy does not meet the requirements of a new regulation. The CISO must decide how to address the gap. Which action is most appropriate?

   • AUpdate the retention policy to meet the new regulation, but do not implement it until the next audit.
   • BIgnore the gap because the regulation is new and not yet enforced.
   • CConduct a gap analysis to determine the impact of the non-compliance and develop a remediation plan with prioritized actions.
   • DImmediately delete all data that may be affected, regardless of legal holds.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A multinational company operates in the EU, US, and Asia. It processes personal data of EU residents, California residents, and financial data subject to GLBA. The CISO must design a compliance framework that addresses all applicable regulations. Which approach is most effective?

   • AOutsource all compliance to a third-party provider to avoid legal responsibility.
   • BComply only with GDPR because it is the most stringent, and ignore other regulations.
   • CImplement separate compliance programs for each regulation, with no cross-referencing.
   • DImplement a unified privacy program that maps controls to GDPR, CCPA, and GLBA, and uses the most stringent requirement as the baseline.
   Reveal Solution Discussion Select an answer first