A compliance officer needs to brief the CEO on the organization's compliance status with the Sarbanes-Oxley Act (SOX). The CEO is not familiar with technical controls and prefers a high-level summary. Which communication approach is most effective for this audience?

Focus only on the controls that failed the last audit and propose immediate remediation.

Present a detailed list of all IT general controls (ITGCs) and their implementation status.

Provide a dashboard showing the overall compliance posture, key risks, and trends using business-oriented language.

Email the full SOX compliance report and ask the CEO to review it before the next board meeting.

What is the primary difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI) in compliance?

KPIs measure the effectiveness of compliance activities, while KRIs measure the level of risk exposure.

KPIs are lagging indicators, while KRIs are leading indicators.

KPIs are used for external reporting, while KRIs are used internally.

KPIs are quantitative, while KRIs are qualitative.

What is the first step in the compliance framework selection process?

Implement the framework immediately to save time.

Hire an external consultant to choose the framework.

Identify the organization's compliance requirements and objectives.

Select the most widely used framework in the industry.

Which activity is part of compliance framework implementation planning?

Conducting an external audit to certify compliance.

Allocating resources for remediation activities.

Decommissioning all legacy systems.

Selecting a new framework based on vendor recommendations.

A compliance manager at a manufacturing company is responsible for monitoring adherence to the ISO/IEC 27001 framework. The company has a mature set of controls, but the compliance team is struggling to identify emerging risks before they become audit findings. Which monitoring approach would best address this challenge?

Rely on the external auditor's report as the primary source of risk information.

Implement a continuous control monitoring (CCM) solution that automates the collection and analysis of control evidence.

Conduct an annual internal audit and report the findings to senior management.

Increase the frequency of management reviews to quarterly without changing the data collection process.

Information Systems Security Management Professional

Domain 6Objective 3

6.3 Validate Compliance in Accordance with Applicable Laws, Regulations, and Industry Standards ISSMP Practice Questions (Page 3)

Part of the Law, Ethics and Security Compliance Management domain, which accounts for 14% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

14%of the exam

7 Concepts in This Objective

Compliance Communication to Senior Management
Compliance Framework Evaluation Criteria
Compliance Framework Selection Process
Compliance Framework Implementation Planning
Compliance Framework Operationalization
Compliance Metrics Definition
Compliance Monitoring and Reporting

Questions 11–15

11application · medium
A compliance officer needs to brief the CEO on the organization's compliance status with the Sarbanes-Oxley Act (SOX). The CEO is not familiar with technical controls and prefers a high-level summary. Which communication approach is most effective for this audience?
Select an answer first
12foundation · easy
What is the primary difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI) in compliance?
Select an answer first
13foundation · easy
What is the first step in the compliance framework selection process?
Select an answer first
14foundation · easy
Which activity is part of compliance framework implementation planning?
Select an answer first
15application · medium
A compliance manager at a manufacturing company is responsible for monitoring adherence to the ISO/IEC 27001 framework. The company has a mature set of controls, but the compliance team is struggling to identify emerging risks before they become audit findings. Which monitoring approach would best address this challenge?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.