Specific controls, frameworks, and compliance

Question 1

(CIA) triad

Answer 1

confidentiality, integrity, and availability

Question 2

security controls

Answer 2

safeguards designed to reduce specific security risks. So they are used alongside frameworks to ensure that security goals and processes are implemented correctly and that organizations meet regulatory compliance requirements.

Question 2

Security frameworks

Answer 2

guidelines used for building plans to help mitigate risks and threats to data and privacy. They have four core components:

Identifying and documenting security goals

Setting guidelines to achieve security goals

Implementing strong security processes

Monitoring and communicating results

Question 3

Compliance

Answer 3

process of adhering to internal standards and external regulations.

Question 4

National Institute of Standards and Technology (NIST)

Answer 4

U.S.-based agency that develops multiple voluntary compliance frameworks that organizations worldwide can use to help manage risk

Question 5

The Federal Energy Regulatory Commission - North American Electric Reliability Corporation (FERC-NERC)

Answer 5

FERC-NERC is a regulation that applies to organizations that work with electricity or that are involved with the U.S. and North American power grid. These types of organizations have an obligation to prepare for, mitigate, and report any potential security incident that can negatively affect the power grid. They are also legally required to adhere to the Critical Infrastructure Protection (CIP) Reliability Standards defined by the FERC

Question 6

The Federal Risk and Authorization Management Program (FedRAMP®)

Answer 6

FedRAMP is a U.S. federal government program that standardizes security assessment, authorization, monitoring, and handling of cloud services and product offerings. Its purpose is to provide consistency across the government sector and third-party cloud providers.

Question 7

Center for Internet Security (CIS®)

Answer 7

CIS is a nonprofit with multiple areas of emphasis. It provides a set of controls that can be used to safeguard systems and networks against attacks. Its purpose is to help organizations establish a better plan of defense. CIS also provides actionable controls that security professionals may follow if a security incident occurs.

Question 8

General Data Protection Regulation (GDPR)

Answer 8

GDPR is a European Union (E.U.) general data regulation that protects the processing of E.U. residents’ data and their right to privacy in and out of E.U. territory. For example, if an organization is not being transparent about the data they are holding about an E.U. citizen and why they are holding that data, this is an infringement that can result in a fine to the organization. Additionally, if a breach occurs and an E.U. citizen’s data is compromised, they must be informed. The affected organization has 72 hours to notify the E.U. citizen about the breach.

Question 9

Payment Card Industry Data Security Standard (PCI DSS)

Answer 9

PCI DSS is an international security standard meant to ensure that organizations storing, accepting, processing, and transmitting credit card information do so in a secure environment. The objective of this compliance standard is to reduce credit card fraud.

Question 10

The Health Insurance Portability and Accountability Act (HIPAA)

Answer 10

HIPAA is a U.S. federal law established in 1996 to protect patients’ health information. This law prohibits patient information from being shared without their consent. It is governed by three rules:

Privacy

Security

Breach notification

Question 11

Protected Health Information (PHI)

Answer 11

PHI relates to the past, present, or future physical or mental health or condition of an individual, whether it’s a plan of care or payments for care.

Question 12

International Organization for Standardization (ISO)

Answer 12

ISO was created to establish international standards related to technology, manufacturing, and management across borders. It helps organizations improve their processes and procedures for staff retention, planning, waste, and services.

Question 13

System and Organizations Controls (SOC type 1, SOC type 2)

Answer 13

developed by The American Institute of Certified Public Accountants® (AICPA) The SOC1 and SOC2 are a series of reports that focus on an organization’s user access policies at different organizational levels such as:

Associate

Supervisor

Manager

Executive

Vendor

Others