6.3 Validate Compliance in Accordance with Applicable Laws, Regulations, and Industry Standards ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A financial services firm has implemented the NIST Cybersecurity Framework (CSF) and needs to report compliance status to the board of directors. The compliance team wants to provide a clear, actionable metric that reflects the organization's overall risk posture and progress toward full CSF implementation. Which metric is most appropriate for this purpose?

   • ATotal cost of security tools and services purchased this year.
   • BPercentage of employees who completed annual security awareness training.
   • CPercentage of CSF subcategories with implemented controls mapped to the organization's systems.
   • DNumber of security incidents detected in the last quarter.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When reporting compliance status to senior management, which approach is most effective?

   • AShare the raw compliance data with management and let them interpret it.
   • BOnly report when a major compliance failure occurs.
   • CPresent a summary of key compliance metrics, trends, and significant risks in business terms.
   • DProvide a detailed technical report with all control names and configurations.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of a gap analysis during compliance framework implementation?

   • ATo test the framework's effectiveness.
   • BTo compare the framework with other frameworks.
   • CTo identify differences between current practices and framework requirements.
   • DTo allocate the entire budget to security controls.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has completed the gap analysis and implementation planning for the NIST Cybersecurity Framework (CSF). The next step is to operationalize the controls. Which action is most critical to ensure the controls are effectively integrated into daily operations?

   • ADocument the controls in a policy manual and store it on the internal wiki.
   • BAssign clear ownership for each control and integrate the control activities into existing job roles and workflows.
   • CConduct a one-time training session for all employees on the new controls.
   • DPurchase a new SIEM tool to automate all control monitoring.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A compliance officer must report to the board of directors on the organization's compliance with the General Data Protection Regulation (GDPR). The board is concerned about the potential financial impact of non-compliance. The compliance officer has access to data on the number of data subject requests (DSRs) processed, the time taken to respond, and the number of DSRs that missed the 30-day deadline. Which metric would be most effective in communicating the compliance risk to the board?

   • AThe number of DSRs that were escalated to the legal department.
   • BThe total number of DSRs processed in the last quarter.
   • CThe average time taken to respond to DSRs in days.
   • DThe percentage of DSRs that missed the 30-day deadline, along with the potential fines for each missed deadline.
   Reveal Solution Discussion Select an answer first