Domain 6 Flashcards
What occurs when a customer is dissuaded from leaving a provider even when it’s the best decision?
Vendor lock-in
What’s an industry standard that provides guidance for eDiscovery programs?
ISO 27050
What provides industry standard guidance for information privacy programs?
ISO 27701
Who is the entity that uses the data on behalf of the owner/controller?
Data processor
Who is the person the PII describes?
Data subject
Who is the entity that creates the PII?
Data owner/controller
Who are entities that regulate the use of PII?
Regulators
Is it proper to script a testimony in court?
No, but coaching is okay
Is deploying a firewall a risk mitigation strategy?
Yes
________ is a strategy where an organization decides to accept the potential risks and associated outcomes of a particular security threat rather than avoiding or mitigating it
Risk acceptance
What is a metric that indicates the degree to which your organization requires its information to be protected against confidentiality leaks or compromised data integrity?
Risk tolerance - how much risk you can tolerate
What is when an org completely avoids the activity that carries the potential risk.
Risk avoidance
This is when you transfer the risk to another party when accepting or avoiding the risk yourself is not feasible
Risk transfer
If the risk then happens, the responsibility or loss will not fall solely on one party.
Risk sharing
What is the act of adding extra resources, time, or personnel to mitigate the potential impact of a risk.
Risk buffering
Involves creating a contingency plan or “Plan B” for certain risks.
Risk strategizing
This is the performance of tests (usually many tests) to verify that a project is secure and functions as intended.
Risk testing
This allows an organization to determine the potential financial implications of a risk event.
Risk quantification
This is the implementation of risk controls to mitigate potential hazards or bad outcomes that may arise during a project or with an enterprise.
Risk reduction
This uses digital tools and technologies to transform how businesses recognize, evaluate, control, and reduce risks.
Risk digitization
What function tests the effectiveness of controls?
Audit
This is when you communicate a change in privacy practices to customers.
Notice
This is when you offer customers an opportunity to opt out of use of their data.
Choice and consent
This principle says individuals should be able to review and update their personal information.
Access
T/F: SOX is applicable to all companies.
False, only publicly traded companies
What protects your personal student information?
FERPA
What happens when an org decides that taking no action is the most beneficial route to managing a risk?
Risk acceptance
What standard applies only to financial institutions but regulates privacy of customers financial info?
GLBA
What’s the proper course of action when records are not available?
Write a statement of scope limitation that describes issue and impact on the audit.
What prohibits entities w/in a country that has no nationwide privacy laws from gathering or processing privacy data belonging to EU citizens?
GDPR
- Their country has no laws that comply w/ EU laws
- Entity creates contractual language that complies w/ EU laws and has language approved by each EU country from which the entity wishes to gather citizen data.
- Entity voluntarily subscribes to its own nation’s privacy shield program
Conditions that allow gathering/processing privacy data for EU citizens for GDPR
What’s used to capture the impact on intangible factors such as customer confidence, employee morale, and reputation in a BIA?
Qualitative tools
What are audit standards for service providers?
SAS 70 and SSAE 18
_________ are how SSAE 18 audits are conducted.
SOC reports
What’s the way to verify that an organization is following some specific best practices before you outsource a business function to that organization.
SOC (service organization controls) report
What report is based on the Trust Services Criteria (formerly known as the Trust Service Principles) established by the AICPA and focuses on:
Security
Availability
Processing integrity
Confidentiality
Privacy
SOC 2
What report evaluates the management’s description of a service organization’s system and the suitability of the design and operating effectiveness of controls over an extended period of time.
SOC2 Type2
What report evaluates the management’s description of a service organization’s system and the suitability of the design of controls at a specific point in time.
SOC2 Type1
What is the current AICPA audit standard?
SSAE 18
What law helps ensure public companies engage in non-deceptive business accounting practices.
SOX
What requires publicly traded companies doing business in the U.S. to establish financial reporting standards, including safeguarding data, tracking attempted breaches, logging electronic records for auditing, and proving compliance.
SOX compliance
Does digital forensics include creation of data?
No
This includes reviewing the organization’s current position/performance as revealed by an audit against a given standard.
Gap analysis
This is a method of assessing the performance of a business unit to determine whether business requirements or objectives are being met
Gap analysis
What’s a good tool for analyzing financial risk?
Quantitative risk assessment
What’s a good tool for intangible risks?
Qualitative risk assessment
What describes privacy requirements for cloud providers, including annual audit mandate?
ISO 27018
What does NIST SP 800-37 describe?
Risk management framework
SSN, DL#, state ID#, credit/debit #, bank acct #, medical records, health insurance info are all covered by _____.
California’s data breach notification law
What gives a customer better assurance of not being constrained to a given provider?
When the customer can ensure their data will not be ported to a proprietary data format or system
T/F: A platform-agnostic data set is less portable and more subject to vendor lock in.
False, it’s more portable and less subject
The ease and speed at which a customer can access their own data can influence:
How readily the data might be moved to another provider.
What’s the greatest motivating factor for a provider to meet SLAs?
financial penalties
What’s the quantitative analysis of all risks facing an organization and their potential impact?
Org’s risk profile
What’s the amount of risk an org is willing to accept?
Risk appetite
T/F: Risk appetite is a conceptual target, whereas risk profile is an assessment of the actual situation.
True
What addresses the privacy aspect of cloud computing for consumers and was the first international set of privacy controls in the cloud?
ISO 27018
What documents a relationship b/w two orgs?
memorandum of agreement
What is required to prevent possible destruction of pertinent evidence?
litigation hold
PHI is a form of PII that includes _____.
health info
What’s the risk that a vendor will not be able to continue operations and a shutdown will adversely impact customers?
Vendor viability
What is it called when a vendor prevents a customer from gaining access to their info?
vendor lockout
What lowers the probability or impact of risk occuring?
Risk mitigation
What addresses issues of data confidentiality?
NDAs
Forbids the transfer of data to countries that lack adequate privacy protections
GDPR
Requires CSPs to hand over data to aid in investigation of serious crimes, even if stored in another country.
Clarifying Lawful Overseas Use of Data (CLOUD) Act
US companies can’t export to Cuba, Iran, North Korea, Sudan, and Syria.
Computer export controls
Dept of Commerce details limitations on export of encryption products outside the US.
Encryption export controls
The basis for privacy rights is in the Fourth Amendment to the U.S. Constitution.
Privacy US
Legal rules that are created by government entities, such as legislatures/congress.
Laws
Rules that are created by governmental agencies.
Regulations
Dictate a reasonable level of performance. They can be created by an organization for its own purposes (internal) or come from industry bodies or trade groups (external).
Standards
A set of guidelines helping organizations improve their security posture.
Frameworks
7 articles of constitution
I - legislative
II - executive
III - judicial
IV - defines relationship b/w state/fed gov
V - amending constitution
VI - constitution is supreme law of land
VII - establishes federal gov
Interpretations made by courts over time establish a body of law that other courts may refer to when making their own decisions.
case law
Is a set of judicial precedents passed down as case law through many generations.
common law
_____ means “responsible or answerable in law; legally obligated”.
Liable
Occurs when one person claims that another person has failed to carry out a legal duty that they were responsible for.
Civil liability
Civil cases are brought to court by one party, called the _____, who is accusing another party of a violation, called the _____.
claimant / respondent
Are another form of civil violation that do not involve a contract but instead, involve harm to one party caused by the actions of another party.
torts
Is a commonly occurring tort that occurs when one party causes harm to another party by their action or lack of action.
negligence
The person accused of negligence must have an established responsibility to the accuser.
duty of care
The basis for privacy rights is in the _____ to the U.S. Constitution.
Fourth Amendment
Cuba, Iran, North Korea, Sudan, and Syria are all countries the ______.
US can’t export to
_____ are the legal rules that are created by government entities, such as legislatures/congress.
Laws
_____ are the rules that are created by governmental agencies.
Regulations
_____ dictate a reasonable level of performance.
Standards - they can be internal or external
