CASP 003 UPDATED ACTUAL Exam
Questions and CORRECT Answers
Save
Terms in this set (274)
Risk 1. identification 2. assessment 4.
Management analyzation 5. mitigation
Process
1. categorize the info systems and
data 2. select security controls 3.
NIST SP 800-39
implement controls 4. assess the
RMF six unique
effectiveness of the controls 5.
stages
authorize the info system 6. monitor
the controls (CSIAAM)
, The ISO/IEC 27000-series (also
known as the 'ISMS Family of
Standards' or 'ISO27K' for short)
comprises information security
standards published jointly by the
International Organization for
Standardization (ISO) and the
International Electrotechnical
Commission (IEC).[1]
The series provides best practice
recommendations on information
ISO/IEC 27000
security management—the
management of information risks
through information security
controls—within the context of an
overall Information security
management system (ISMS), similar
in design to management systems
for quality assurance (the ISO 9000
series), environmental protection
(the ISO 14000 series) and other
management systems
requires financial institutions to
Gramm-Leach-
ensure the security and
Bliley Act
confidentiality of customer data (PII)
, established requirements for proper
financial record keeping for public
Sarbanes-Oxley
companies and penalties of as much
Act of 2002
as 25 years in prison for
noncompliance
federal info security management
act - US law requires federal
FISMA
agencies to create, document and
implement security program
payment card industry data security
standard - security standards for
credit card companies to protect
PCI DSS
transactions and data. It is a
contractual requirement although
some states treat it as law.
2002 directive - aimed at privacy
and electronic communications
EU Directive service providers to provide
2002/58/EC and security with services. 2009
2009/136/EC directive - amended to require user
consent before cookies are installed
(the cookie law)
, GDPR (General New European Union law on data
Data Protection protection and privacy for
Regulation) individuals for all EU citizens
bill the U.S. created in 2018 that
empowers the gov to issue warrants
Cloud Act that compel Americans businesses
to pull data from their servers
stored locally and internationally
COBIT (Control Framework set of best practices for
Objectives for IT management created by ISACA
Information and and the ITGI, assists orgs in
related maximizing the benefits from the
Technology) use of information technology
Health Information Technology for
Economic and Clinical Health Act -
widens the scope of privacy and
security protections available under
HITECH HIPAA, imposes data breach
notification requirements, increases
legal liability for noncompliance,
and extends to software vendors of
electronic medical records.
Questions and CORRECT Answers
Save
Terms in this set (274)
Risk 1. identification 2. assessment 4.
Management analyzation 5. mitigation
Process
1. categorize the info systems and
data 2. select security controls 3.
NIST SP 800-39
implement controls 4. assess the
RMF six unique
effectiveness of the controls 5.
stages
authorize the info system 6. monitor
the controls (CSIAAM)
, The ISO/IEC 27000-series (also
known as the 'ISMS Family of
Standards' or 'ISO27K' for short)
comprises information security
standards published jointly by the
International Organization for
Standardization (ISO) and the
International Electrotechnical
Commission (IEC).[1]
The series provides best practice
recommendations on information
ISO/IEC 27000
security management—the
management of information risks
through information security
controls—within the context of an
overall Information security
management system (ISMS), similar
in design to management systems
for quality assurance (the ISO 9000
series), environmental protection
(the ISO 14000 series) and other
management systems
requires financial institutions to
Gramm-Leach-
ensure the security and
Bliley Act
confidentiality of customer data (PII)
, established requirements for proper
financial record keeping for public
Sarbanes-Oxley
companies and penalties of as much
Act of 2002
as 25 years in prison for
noncompliance
federal info security management
act - US law requires federal
FISMA
agencies to create, document and
implement security program
payment card industry data security
standard - security standards for
credit card companies to protect
PCI DSS
transactions and data. It is a
contractual requirement although
some states treat it as law.
2002 directive - aimed at privacy
and electronic communications
EU Directive service providers to provide
2002/58/EC and security with services. 2009
2009/136/EC directive - amended to require user
consent before cookies are installed
(the cookie law)
, GDPR (General New European Union law on data
Data Protection protection and privacy for
Regulation) individuals for all EU citizens
bill the U.S. created in 2018 that
empowers the gov to issue warrants
Cloud Act that compel Americans businesses
to pull data from their servers
stored locally and internationally
COBIT (Control Framework set of best practices for
Objectives for IT management created by ISACA
Information and and the ITGI, assists orgs in
related maximizing the benefits from the
Technology) use of information technology
Health Information Technology for
Economic and Clinical Health Act -
widens the scope of privacy and
security protections available under
HITECH HIPAA, imposes data breach
notification requirements, increases
legal liability for noncompliance,
and extends to software vendors of
electronic medical records.
