5.2 Governance - Regulations, Standards & Frameworks

Question 1

Define General Data Protection Regulation (GDPR) (4)

Answer 1

1. Laws applying to personal information in data in the EU
2. Allows people to understand and control their personal data collected by companies
3. Prohibits export of personal data outside of the EU
4. Requires posting of detailed privacy policies regarding personal data

Question 2

Define Payment Card Industry Data Security Standard (PCI DSS) (2)

Answer 2

1. Rules regarding credit card transaction transmissions and credit card data storage
2. Not laws, but an organization setup by credit card companies to develop standards

Question 3

Define Center for Internet Security (CIS) Framework

Answer 3

Developed critical security controls (CSC) framework with different security recommendations based on the size of an organization

Question 4

Define NIST Risk Management Framework (RMF)

Answer 4

Framework federal government agencies are required to follow

Question 5

Define NIST Cybersecurity Framework (CSF)

Answer 5

Framework for non-government corporate entities

Question 6

Define International Organization Standardization (ISO) Frameworks

Answer 6

Developed for international organizations

Question 7

Define SSAE SOC 2 Type I/II (3)

Answer 7

1. Security auditing standard developed by the American Institute of Certified Public Accountants, or the AICPA
2. Type I - audits/tests controls at a particular date/time
3. Type II - audits/tests controls over a 6 month or longer time frame

Question 8

Define benchmarks/secure configuration guides

Answer 8

1. Hardening secure configuration guides created for specific OS or platforms
2. Can be from vendor or industry groups

Question 9

What devices types do benchmarks/secure configuration guides apply to?

Answer 9

1. Web servers
2. OS
3. Application servers
4. Network devices