CISSP Legal and Compliance Flashcards
6 cards from real CISSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CISSP Legal and Compliance flashcards as text
What does the term 'due diligence' mean in the context of information security governance?
Answer: Investigating and verifying security practices before entering a business relationship
Due diligence involves proactively investigating security posture, risks, and controls before a merger, acquisition, or vendor engagement.
Which US law requires publicly traded companies to maintain accurate financial records and internal controls, with CISOs often accountable for IT controls?
Answer: SOX (Sarbanes-Oxley Act)
SOX Section 404 requires management to assess internal controls over financial reporting, which heavily involves IT systems and access controls.
Under the EU GDPR, what is the maximum fine for the most serious violations?
Answer: €20 million or 4% of global annual turnover
GDPR's highest tier penalty is €20 million or 4% of global annual turnover, whichever is higher, for severe violations.
What is the main purpose of a privacy impact assessment (PIA)?
Answer: To identify and mitigate privacy risks before deploying new systems or processes
A PIA proactively identifies privacy risks in new projects and recommends controls before the system is built or deployed.
Which regulation governs the security and privacy of student education records in the US?
Answer: FERPA
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records and grants parents/students access rights.
What is the primary purpose of intellectual property (IP) law in information security?
Answer: To grant exclusive rights over creative works and inventions, protecting them from unauthorized use
IP law (including copyright, patents, and trade secrets) protects ownership rights over software, inventions, and proprietary information.