Legal, Regulatory and Contractual Requirements CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following activities is a key component of an effective compliance management process?

   • ADelegating all compliance activities to the legal department
   • BConducting periodic compliance reviews and audits
   • CPerforming a one-time risk assessment at the start of a project
   • DFocusing only on regulatory requirements and ignoring contractual ones
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following BEST describes the role of regulatory requirements in information security governance?

   • AThey are best practices that are recommended but not enforced
   • BThey are voluntary guidelines that organizations may choose to adopt
   • CThey are internal policies developed by the organization's board of directors
   • DThey are mandatory rules issued by a governing body that organizations must comply with
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is planning to share patient data with a research institution for a clinical study. The information security manager must assess the impact of this data sharing on the organization's compliance posture. Which factor is most important to consider in this impact assessment?

   • AThe research institution's physical security measures.
   • BThe research institution's reputation in the academic community.
   • CThe cost of anonymizing the data before sharing.
   • DThe legal basis for sharing the data under HIPAA and any applicable state laws.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial services firm is outsourcing its customer support to a third-party call center. The contract includes a requirement for the call center to report any security incident within 24 hours. The information security manager is designing the compliance monitoring process. What is the most effective way to verify the call center is meeting this contractual obligation?

   • AConducting an annual on-site audit of the call center's incident response procedures.
   • BRequiring the call center to submit a monthly compliance report that includes all incidents reported during the period.
   • CIncluding a clause in the contract that allows the firm to terminate the agreement if the call center fails to report incidents.
   • DImplementing an automated ticketing system that timestamps each incident report and is accessible to the firm.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a contract with a vendor that requires the vendor to comply with the company's information security policies. The information security manager discovers that the vendor is not complying with the policy on data retention. What is the most appropriate action?

   • AWork with the vendor to develop a corrective action plan to address the non-compliance.
   • BIgnore the issue because the vendor is a third party and the company is not responsible.
   • CTerminate the contract immediately for breach of contract.
   • DReport the vendor to the relevant regulatory authority.
   Reveal Solution Discussion Select an answer first