Privacy Frameworks

85 flashcards

Operations, Reporting, and Compliance.: What are the three objectives of the 2013 COSO Framework?
How transactions are recorded and verified using consensus mechanisms, smart contracts, and distributed ledgers.: What significant change does blockchain introduce?
A permanent, immutable, transparent, and distributed/shared ledger of transactions.: What does blockchain create?
A decentralized, distributed ledger technology that securely and permanently records transactions.: How is blockchain defined?
Automated rule execution via smart contracts, continuous real-time transaction logging, and shared visibility.: What processes are commonly automated with blockchain?
Strategy, business objectives, governance, risk appetite, operational context, and value creation.: What does successful Enterprise Risk Management (ERM) address?
A set of policies, processes, and controls designed to protect information assets from cybersecurity risks.: What is an entity's cybersecurity risk management program?
The infrastructure, software, people, processes, and data designed to achieve specific business objectives.: What do the terms information and systems refer to?
An occurrence arising from unauthorized access, or use that impairs the availability, integrity, or confidentiality of systems.: What is a security event?
A loss of confidentiality, integrity, or availability of information.: What does compromise refer to in cybersecurity?
Objectives that address cybersecurity risks affecting the entity's overall business objectives.: What are cybersecurity objectives?
Management is responsible for designing, implementing, operating, and evaluating the program.: Who is responsible for the cybersecurity risk management program?
Whether the description is presented in accordance with the AICPA Description Criteria.: What does the CPA express an opinion on when attesting the cybersecurity risk management program?
The principal types of sensitive information that are vulnerable to cybersecurity risk.: What should be considered regarding the nature of information at risk?
Guarding against improper modification, ensuring authenticity and accountability.: What does integrity of data mean?
Security incidents that occurred in the 12-month period preceding the period end date.: What must an entity's cybersecurity risk management program include?
Analyzing business context, defining risk appetite, and evaluating alternative strategies.: What are the three components of the COSO 2017 ERM Framework Strategy?
Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, Information, Communication & Reporting.: What are the five components of Risk Management?
Governance, Strategy, Performance, Review/Revision, Information & Communication, and Culture.: What are the six components of an Organization's Cyber Risk Management Program?
Line A: Risk Appetite; Line B: Risk Capacity; Line C: Risk Tolerance.: What do lines A, B, and C represent in the Risk Tolerance Threshold diagram?
Alignment of IT strategy with business goals, value delivery, risk optimization, and performance measurement.: What does the context of Enterprise Governance of Information and Technology (EGIT) include?
Enterprise value generation through the strategic alignment and optimal execution of I&T investments.: What is the basic principle of I&T value delivery?
Creation of enterprise benefits.: What does value delivery focus on?
Value preservation and exposure mitigation.: What does risk management focus on?
Effective and efficient management and deployment of IT applications, infrastructure, and workforce capabilities.: What are key elements of resources optimization?
Regulators, business partners, customers, external auditors, vendors, and shareholders.: Who are external stakeholders of COBIT?
Principles for a Governance System and Principles for a Governance Framework.: What principles was COBIT 2019 developed based on?
Processes, Organizational Structures, Principles/Policies/Frameworks, Information, Culture/Ethics/Behavior, People/Skills/Competencies, and Services/Infrastructure/Applications.: What are the components of a Governance System according to COBIT?
A customer-oriented service culture and operational business goal.: What does the statement 'The enterprise has a focus on providing stable and client-oriented service' describe?
The strategic role of IT (Design Factor).: What does the statement 'IT is critical for both running and innovating the organization's business processes and services' describe?
Stakeholder Drivers & Needs ’ Enterprise Goals ’ Alignment Goals ’ Governance and Management Objectives.: What is the sequence of the COBIT Goals Cascade?
Managed strategy, quality, risk, and security.: What are the Core COBIT 2019 Management Objectives?
Administrator accounts, application, authentication systems, authorization systems.: What are key components of logical access control and identity management systems?
End-user devices, network devices, non-computing/IoT devices, servers, and cloud/virtual infrastructure.: What does an enterprise asset include?
Mobile end-user devices, network devices, network infrastructure, non-computing/Internet of Things (IoT) devices.: What categories are inventoried under CIS Control 01?
Any physical, virtual, or cloud device connected directly or logically to the enterprise infrastructure.: What is the definition of an enterprise asset according to Control 01?
Malware execution and unpatched vulnerabilities.: What does Control 02 (Software Asset Management) aim to prevent?
Data management process, data inventory, data access control lists, data retention.: What are the core safeguards for Data Protection under CIS Control 03?
The secure configuration of enterprise assets (hardware, software, network devices, mobile systems, and operating systems).: What should an enterprise establish and maintain according to Control 04?
Authorization to credentials for user accounts and administrative accounts.: What should processes and tools manage according to Control 05?
Multi-Factor Authentication (MFA), Centralized Directory Services (e.g., Active Directory/IAM), and Access Control Lists (ACLs).: What are examples of tools to achieve CIS Control 6 (Access Control Management)?
A plan to continuously assess and track vulnerabilities on enterprise assets (Vulnerability Management).: What should an enterprise develop according to Control 07?
Audit/System event logs and Network traffic logs.: What are the two types of logs mentioned in Control 08?
Email and web browser defenses designed to block malicious content and phishing attacks.: What does Control 09 aim to defend against?
Prevent, detect, and isolate unauthorized malicious code execution.: What do Malware Defenses (Control 10) aim to do?
Recovery Time Objectives, Recovery Point Objectives, and data criticality.: What should be considered when developing backup frequency and type according to Control 11?
IT system structure, network infrastructure, data warehouse, data library.: What are architectural data elements evaluated during disaster recovery and backup planning?
Monitoring and defense, penetration and programming, testing and recording, design and log.: What are the safeguards under Network Infrastructure Management and Network Monitoring/Defense?
Buffer overflows, exposure to Structured Query Language (SQL) injection, cross-site scripting.: What are common application-level software vulnerabilities addressed by application security controls?
Incident response management, designated personnel, recovery plans, and routine exercise testing.: What does a comprehensive cybersecurity program include according to Control 17?
Penetration testing simulates active attacks to evaluate security control effectiveness; Vulnerability scanning identifies potential vulnerabilities.: What is the difference between penetration testing and vulnerability scanning according to Control 18?
Inspect, review, request amendments to, and obtain copies of their PHI, as well as receive an accounting of disclosures.: What rights does the Privacy Rule give patients regarding their protected health information (PHI)?
Electronic protected health information (ePHI), which includes individually identifiable health information created, received, maintained, or transmitted by covered entities or business associates in any format.: What does the Privacy Rule protect?
To help organizations manage privacy risks arising from data processing through enterprise risk management and protect individual privacy.: What is the purpose of the 'Privacy Framework' published by NIST?
Cybersecurity risks stem from unauthorized security events; Privacy risks stem from data processing actions that create adverse impacts for individuals.: What is the relationship between cybersecurity risk and privacy risk?
Data processing problems cause adverse impacts to individuals, leading to organizational impacts like brand damage and regulatory fines.: What is the relationship between data processing problems and organizational impacts?
Technical security protections and broader privacy impacts arising from data processing activities.: What do privacy risk assessments help organizations distinguish between?
Identify, Govern, Control, Communicate, Protect.: What are the core functions of the NIST Privacy Framework?
1. Partial, 2. Risk-Informed, 3. Repeatable, 4. Adaptive.: What are the four tiers of the Privacy Framework?
Federal security and privacy compliance.: What do Circular A-130, FISMA, and the Privacy Act of 1974 govern?
Security requirements and privacy requirements.: What does the term 'requirement' include in this guideline?
Capability requirement, specification requirements, derived requirements, statement of work requirements.: What are the categories of security and privacy requirements established during system life cycle design?
The baseline security or privacy control in a control family.: What is a base control?
An enhancement of a base control providing additional capability or specificity for higher-risk environments.: What is a control enhancement?
Controls implemented specifically for one system.: What is a system-specific control?
Controls shared across multiple organizational systems or programs.: What are hybrid controls?
Security functionality and security assurance.: What are the two fundamental concepts that affect the trustworthiness of systems?
AICPA Assurance Services Executive Committee (ASEC).: Who established the 2017 Trust Services Criteria?
Logical and physical access controls, change management, and risk mitigation: What additional criteria supplement COSO principles in the trust services criteria?
Common Criteria and Additional Category-Specific Criteria.: What are the two types of criteria in Trust Services Criteria?
Security, Availability, Processing Integrity, Confidentiality, and Privacy.: What are the five Trust Services Categories?
System protection against unauthorized access.: What does security mean in the context of Trust Services?
System accessibility for operation.: What does availability mean in the context of Trust Services?
Complete, valid, accurate, timely processing.: What does processing integrity mean in the context of Trust Services?
Protection of restricted information.: What does confidentiality mean in the context of Trust Services?
Proper personal information collection, use, retention, and disclosure.: What does privacy mean in the context of Trust Services?
Controls relevant to internal control over financial reporting.: What do SOC 1 reports focus on?
Controls relevant to Trust Services Criteria.: What do SOC 2 reports focus on?
SOC 1 reports on financial reporting controls; SOC 2 reports on Trust Services Criteria.: What is the difference between SOC 1 and SOC 2 reports?
Audit that checks how well a company protects its production and shipping networks from disruptions and security threats: What is the purpose of SOC for Supply Chain?
Relevance, Objectivity, Measurability, and Completeness.: What are the attributes of suitable criteria of attestation standards?
The entity demonstrates a commitment to integrity and ethical values.: What does COSO Principle 1 emphasize?
The board of directors demonstrates independence from management and exercises oversight.: What does COSO Principle 2 emphasize?
Management establishes structures, reporting lines, and responsibilities with board oversight.: What does COSO Principle 3 emphasize?
The entity demonstrates a commitment to attract, develop, and retain competent individuals.: What does COSO Principle 4 emphasize?