CSS CSS Compliance & Regulatory Frameworks 1 — Questions and Answers
Question 1: Which US federal law mandates security controls for federal government information systems and requires FISMA compliance?
- Federal Information Security Modernization Act (FISMA) (Correct answer)
- Sarbanes-Oxley Act (SOX)
- Gramm-Leach-Bliley Act (GLBA)
- Computer Fraud and Abuse Act (CFAA)
Correct answer: Federal Information Security Modernization Act (FISMA)
FISMA requires federal agencies to develop, document, and implement security programs for their information systems, using NIST standards as the framework.
Question 2: What does the NIST Cybersecurity Framework (CSF) core consist of?
- Identify, Protect, Detect, Respond, Recover functions (Correct answer)
- Plan, Do, Check, Act cycle
- Prepare, Prevent, Detect, Respond, Recover phases
- Confidentiality, Integrity, Availability triad
Correct answer: Identify, Protect, Detect, Respond, Recover functions
The NIST CSF organizes security activities into five core functions: Identify, Protect, Detect, Respond, and Recover, providing a common language for managing cybersecurity risk.
Question 3: Which regulation governs the protection of personal health information (PHI) in the United States?
- HIPAA (Health Insurance Portability and Accountability Act) (Correct answer)
- PCI DSS
- FERPA
- GLBA
Correct answer: HIPAA (Health Insurance Portability and Accountability Act)
HIPAA's Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards for electronic PHI.
Question 4: What is the purpose of a System and Organization Controls (SOC 2) audit?
- Evaluates a service organization's controls for security, availability, processing integrity, confidentiality, and privacy (Correct answer)
- Certifies that products meet hardware safety standards
- Audits financial statements for accuracy
- Verifies network penetration testing results
Correct answer: Evaluates a service organization's controls for security, availability, processing integrity, confidentiality, and privacy
SOC 2 reports assess whether a service provider's controls meet the AICPA Trust Service Criteria, particularly relevant for cloud and SaaS providers handling customer data.
Question 5: Which framework provides a comprehensive set of controls for information security management and is the basis for ISO/IEC 27001 certification?
- ISO/IEC 27002 (Code of Practice for Information Security Controls) (Correct answer)
- COBIT
- ITIL v4
- NIST SP 800-53
Correct answer: ISO/IEC 27002 (Code of Practice for Information Security Controls)
ISO/IEC 27002 provides implementation guidance for the information security controls referenced in ISO/IEC 27001, the certifiable ISMS standard.
Question 6: What does data residency compliance require organizations to ensure?
- Personal data is stored and processed within specified geographic boundaries mandated by law (Correct answer)
- Data is encrypted at rest regardless of location
- Data is replicated to multiple global regions for availability
- All data is kept on-premises and never moved to the cloud
Correct answer: Personal data is stored and processed within specified geographic boundaries mandated by law
Data residency laws (such as those in the EU, China, and Russia) require that certain data types remain within the country's borders, affecting cloud storage and processing decisions.
CSS CSS Compliance & Regulatory Frameworks 1
Which US federal law mandates security controls for federal government information systems and requires FISMA compliance?