2.3 Governance, Risk, and Compliance III

Question 1

Codifying and enforcing proper behavior and operations. That is, establishing standards of “right” and “wrong,” and enforcing those standards is ______________?

Answer 1

Governance

Question 2

Enforcing the policies in order to meet those

standards is ______________?

Answer 2

Compliance

Question 3

A __________ is a rule that defines the “right”

behavior.

Answer 3

A policy is a rule that defines the “right”

behavior.

Question 4

__________ inform standards for behavior and operations.

Answer 4

Policies inform standards for behavior and operations.

Question 5

A _____________ defines the policies an organization must have in place.

Answer 5

A governance framework defines the policies an organization must have in place.

Question 6

The two main types of business goals are:

Answer 6

1. Internal/Volitional - Targets that the business sets in its own interest. Ex. An organization might aim to reduce long-term security expenses to less than $400,000.
2. External/Imposed - Targets that the business must hit because they will suffer consequences if they do not.
   Ex. The requirement that online merchants process all credit card transactions securely, or suffer legal penalties if a customer’s PII is breached.

Question 7

There are some rules and policies that must be followed by everyone within an organization or industry. Collections of such policies are called ____________.

Answer 7

There are some rules and policies that must be followed by everyone within an organization or industry. Collections of such policies are called governance frameworks.

Question 8

Frameworks originate from the __________________, the regulatory organization in charge of proposing and enforcing laws regarding financial instruments (for example, stocks, bonds, options), and protecting consumers from fraud.

Answer 8

Frameworks originate from the Securities and Exchange
Commission (SEC), the regulatory organization in charge of proposing and enforcing laws regarding financial instruments (for example, stocks, bonds, options), and protecting consumers from fraud.

Question 9

What is General Data Protection Regulation (GDPR)

Answer 9

protects the private data of all citizens of the EU and European Economic Area (EEA).

Question 10

What is Health Insurance Portability and Accountability Act (HIPAA)

Answer 10

Mandates the protection of medical information.

Question 11

Payment Card Industry Data Security Standard (PCI DSS) requires that companies

Answer 11

Requires that companies handling credit

card transactions do so securely.

Question 12

Title II: ___________________ is a provision establishing privacy standards around electronic access to healthcare data. Organizations must uphold the following standards to remain HIPAA compliant:

Answer 12

Title II: HIPAA Administrative Specification is a provision establishing privacy standards around electronic access to healthcare data. Organizations must uphold the following standards to remain HIPAA compliant:

Question 13

Businesses must enforce policies in order to guarantee __________ with regulations.

Answer 13

Compliance

Question 14

_________ refer to each rule in the framework, and check that the business is following it.

Answer 14

Auditors refer to each rule in the framework, and check that the business is following it.

Question 15

In the event a business is found to be non-compliant in any way, the organization will typically respond by:

Answer 15

• Acknowledging that they are aware of the non-compliance.
• Determining a timeline to fix the issue.
• Developing a plan to bring the organization back into compliance.

Question 16

________________ and ________________ planning focus on contingency plans in the event of a disruption or disaster, and ensure that the business can resume daily operations.

Answer 16

Business continuity planning (BCP) and disaster recovery (DR) planning focus on contingency plans in the event of a disruption or disaster, and ensure that the business can resume daily operations.

Question 17

A breach can have one of two results:

Answer 17

1. Mild / Moderate Breach: The business has been impacted, but can still handle day-to-day operations at a greater cost.
2. Serious / Catastrophic Breach: The business has been impacted so severely that they cannot operate.

Question 18

Instead, they must use their __________ to contain the incident, __________ from the disaster, and eventually __________ to operation.

Answer 18

Instead, they must use their resources to contain the incident, recover from the disaster, and eventually return to operation.

Question 19

What’s the differences between BCP and DR?

Answer 19

Business Continuity Planning focuses on processes
and procedures an organization must consider in
order to ensure business critical functions continue during and after a disaster.

Disaster Recovery focuses on the specific steps an organization must take to resume work after a disaster.

Question 20

Contingency planning results in a contingency policy statement, which establishes the organization’s framework and responsibilities for maintaining
confidentiality, integrity, and availability of data. It includes:

Answer 20

• Responsibilities of an emergency response team
• Resource requirements
• Training requirements
• Schedule for plan maintenance

Question 21

_____________ represents the amount of data that a business can afford to lose/recover (given the most recent backup copy of the data) after a disruption or system outage.

Answer 21

Recovery Point Objective (RPO) represents the amount of data that a business can afford to lose/recover (given the most recent backup copy of the data) after a disruption or system outage.

Question 22

A pivotal step in BCP and DR planning is the Business Impact Analysis and Risk Assessment. Goals include:

Answer 22

• Identify key processes and functions of the business.
• Establish a detailed list of requirements for business recovery.
• Determine the resource requirements needed to resume key processes.
• Evaluate the impact on daily operations.
• Develop priorities and classifications of business processes and functions.
• Develop recovery time requirements.
• Determine financial, operations, and legal impact of disruptions.

Question 23

__________________ is the total amount of time a system can afford to be unavailable for users and the business.

Answer 23

Maximum Tolerable Downtime (MTD) is the total amount of time a system can afford to be unavailable for users and the business.

• Recovery Time Objective (RTO) is the maximum tolerable amount of time needed to bring all critical systems back online after a disaster has occured.
• Work Recovery Time (WRT) is the time available to get the systems working again. WRT is the remainder of the MTD after the RTO. If MTD is four days and RTO is one day, WRT is three days.