Legal Framework & Risk Flashcards
A private organization that oversees the development of voluntary consensus standards for various industries in the U.S.
Example: A manufacturer adheres to a widely recognized safety standard for its equipment to meet compliance requirements.
ANSI - American National Standards Institute
An independent international organization that develops and publishes global standards to ensure quality, safety, efficiency, and interoperability across various industries.
ISO (International Organization for Standardization)
A European Union regulation designed to protect individuals’ privacy and personal data, imposing strict rules on how organizations collect, store, and process personal information.
GDPR (General Data Protection Regulation)
A U.S. federal agency that develops and promotes standards, guidelines, and best practices for technology, including cybersecurity.
Example: An organization uses a widely adopted framework to strengthen its information security policies.
NIST - National Institute of Standards and Technology
A professional organization focused on advancing technology through standards, education, and research in areas like computing and telecommunications.
Example: A company follows a standard for wireless communication protocols to ensure interoperability between devices.
IEEE - Institute of Electrical and Electronics Engineers
A set of security standards created to protect cardholder data and ensure secure payment processing for organizations handling credit and debit card transactions.
PCI DSS (Payment Card Industry Data Security Standard)
Individuals or groups with an interest in the success, failure, or direction of a project, system, or organization.
Example: A group provides input on a new software system because its performance directly affects their daily work.
Stakeholders
Governing bodies responsible for overseeing an organization’s direction, policies, and compliance with legal and ethical standards.
Example: A group reviews an organization’s cybersecurity strategy to ensure it aligns with industry regulations.
Boards
Groups formed within an organization to focus on specific tasks, goals, or decision-making processes.
Example: A team develops a new set of policies to enhance data security and mitigate risks.
Committees
Agencies or departments at the federal, state, or local level that regulate, enforce, or influence standards and practices.
Example: A department issues compliance requirements for businesses handling sensitive public information.
Government Entities
A group of individuals assembled to discuss, decide, or advise on specific organizational, policy, or operational matters.
Example: A team meets regularly to propose updates to security protocols for the organization.
Council
A panel of experts or stakeholders that provides non-binding strategic guidance and advice to an organization or project.
Example: A group recommends adopting new industry standards to enhance the company’s compliance efforts.
Advisory Board
A temporary group established to address a specific problem, issue, or initiative, often with a defined deadline.
Example: A team is created to investigate a recent security breach and propose solutions within 30 days.
Task Force
Agencies or organizations at federal, state, or local levels that perform administrative, regulatory, or enforcement roles.
Example: An organization enforces environmental regulations for industries to protect public health.
Government Entities
Organizations formed by businesses within the same industry to promote collective interests, standards, or policies.
Example: A group lobbies for favorable legislation affecting data privacy in the technology sector.
Trade Associations
Organizations created by law to carry out specific functions, often with regulatory or enforcement authority.
Example: A body monitors compliance with labor laws in the workplace to ensure legal standards are met.
Statutory Bodies
Specialized government entities responsible for creating and enforcing rules within specific industries or sectors.
Example: An agency imposes fines on companies that fail to adhere to data protection laws.
Regulatory Agencies
Responsible for the technical storage and security of data,
Data Custodian
Determines the purpose and means of processing personal data, essentially deciding “why and how” data is used
Data Controller
Holds ultimate responsibility for the data itself, including its accuracy, usage, and compliance
Data Owner
An entity that performs specific data processing tasks under the direction of the Data Controller
Data Processor
A role within an organization that ensures the quality and governance of data assets
Data Steward
An individual whose personal data is collected, stored, or processed by an organization.
Data Subject
The overall process of identifying potential hazards, analyzing their likelihood and severity, and then evaluating the level of risk they pose
Risk Assessment
The initial step of recognizing potential threats or hazards
Risk Identification
Involves breaking down identified risks to understand their potential impact and probability
Risk Analysis
Encompasses the entire process of identifying, analyzing, evaluating, and taking action to mitigate or control identified risks.
Risk Management
The decision to knowingly accept a risk without actively attempting to mitigate it, usually because the potential impact is considered low or the cost of mitigation is too high.
Risk Acceptance
A spontaneous or impromptu process of identifying potential risks, meaning it’s not part of a structured, planned risk management process but rather a quick assessment done on an as-needed basis to address a specific situation or concern, often with a focused approach to identify relevant risks in the moment
Ad Hoc
A method of evaluating risk by assigning numerical values to the likelihood and potential impact of a risk, allowing for a more precise analysis using data and statistical methods.
Quantitative Risk Assessment
