6.3 Validate Compliance in Accordance with Applicable Laws, Regulations, and Industry Standards ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A compliance officer needs to communicate the organization's compliance status with the Sarbanes-Oxley Act (SOX) to the audit committee. The committee is composed of financial experts who are not familiar with IT controls. The compliance officer has access to data on IT general controls (ITGCs), including the number of controls, the number of exceptions, and the remediation status. Which communication approach would be most effective for this audience?

   • AEmail the full SOX compliance report and ask the committee to review it before the next meeting.
   • BFocus only on the ITGCs that have no exceptions to show a positive picture.
   • CProvide a summary of the ITGC exceptions and their potential impact on financial reporting.
   • DPresent a detailed list of all ITGCs and their exception status.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which criterion is most important when evaluating a compliance framework for an organization?

   • AThe framework's popularity among other organizations in the same industry.
   • BThe framework's complexity, regardless of the organization's capacity.
   • CThe framework's cost relative to other options.
   • DThe framework's alignment with the organization's regulatory requirements and business objectives.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a Key Risk Indicator (KRI) for compliance?

   • ANumber of unresolved regulatory violations identified in the last audit.
   • BNumber of compliance training sessions completed per quarter.
   • CPercentage of employees who have completed mandatory training.
   • DTime taken to close compliance findings.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A multinational retail company processes credit card payments in 12 countries and must demonstrate compliance to its acquiring banks. The CISO has been asked to select a compliance framework that provides the most direct path to satisfying the Payment Card Industry Data Security Standard (PCI DSS) while also supporting the company's existing ISO/IEC 27001 certification. Which framework selection approach best meets this need?

   • AImplement ISO/IEC 27001 controls exclusively and submit the Statement of Applicability to the acquiring banks as evidence of PCI DSS compliance.
   • BAdopt NIST Cybersecurity Framework (CSF) as the primary framework and map PCI DSS requirements to its functions.
   • CUse PCI DSS as the primary compliance framework and leverage the existing ISO/IEC 27001 control mappings to streamline the gap analysis.
   • DSelect COBIT 2019 as the primary framework because it covers IT governance and can be tailored to include PCI DSS controls.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A government contractor must comply with NIST SP 800-171 for controlled unclassified information (CUI). The company already uses COBIT 2019 for IT governance. The CISO wants to avoid duplicating efforts. What is the most effective approach to framework selection and implementation?

   • AReplace COBIT 2019 with NIST SP 800-171 and discontinue all COBIT-based governance processes.
   • BUse COBIT 2019 exclusively and submit a letter to the government stating that COBIT satisfies NIST SP 800-171.
   • CAdopt ISO/IEC 27001 instead of NIST SP 800-171 because it is an international standard.
   • DImplement NIST SP 800-171 as the security standard and map its requirements to existing COBIT 2019 governance processes.
   Reveal Solution Discussion Select an answer first