Security Considerations

1. A publicly traded company is subject to a security audit that reviews access controls and audit logging for systems that produce financial statements. The auditor cites SOX Section 404 as the authority. What does SOX require of these systems, and which type of organization is NOT subject to SOX requirements?

A. SOX requires encryption of all financial data; private companies are exempt from SOX B. SOX requires integrity, access controls, and audit logging for IT systems that support financial reporting; private companies (non-publicly traded) are not subject to SOX C. SOX requires annual penetration testing of financial systems; non-profit organizations are exempt D. SOX applies to all organizations that handle US dollar transactions; government agencies are exempt

2. A hospital stores patient medical records on a server that is not encrypted. The server is stolen in a physical break-in. Under HIPAA, what is the hospital's likely obligation, and what would have prevented it?

A. No obligation exists because the theft was a physical crime, not a cyberattack; physical security is outside HIPAA scope B. The hospital must notify affected individuals, HHS, and potentially media because unencrypted PHI was breached; encryption would have rendered the data unusable, exempting the theft from breach notification requirements C. The hospital must notify patients within 72 hours per GDPR requirements; HIPAA does not apply to physical theft D. HIPAA only covers data transmitted over networks; data at rest on stolen physical media is not covered

3. Legal counsel notifies IT that the company is a defendant in a pending lawsuit and issues a directive to preserve all email, documents, and system logs related to a specific project from the past three years. Normal policy deletes email after 90 days and log files after 30 days. What must IT do, and what is this directive called?

A. IT must comply with normal retention policy; legal matters do not override IT operational schedules B. This is a legal hold; IT must immediately suspend automated deletion of covered data and preserve all relevant records for the duration of litigation, overriding normal retention schedules C. This is a data audit; IT must copy the relevant records to a read-only archive but may continue normal deletion of the originals D. This is a regulatory hold; IT must notify the relevant regulator before preserving any data

4. A European company suffers a ransomware attack at 9 AM on Monday and confirms at 3 PM that personal data of EU residents was exfiltrated. Under GDPR, what is the breach notification deadline to the supervisory authority?

A. 60 days from the date the breach is confirmed; GDPR allows organizations time to fully investigate before notifying B. Within 72 hours of becoming aware of the breach; the clock starts at 3 PM Monday when the breach was confirmed, making the deadline 3 PM Thursday C. Within 30 days; the 72-hour rule only applies to healthcare data under HIPAA D. Immediately upon discovery; GDPR requires real-time notification with no grace period

5. A power utility uses SCADA systems to control turbines and distribution switches. The CISO wants to apply monthly OS patches to the SCADA systems on the same schedule as corporate workstations. Why would the operations team likely object?

A. SCADA systems use proprietary operating systems that cannot be patched; the operations team objects because patching is technically impossible B. OT/SCADA systems prioritize availability above all else; patches must be thoroughly tested before deployment because an unplanned outage of control systems can have immediate physical consequences; patching cycles are inherently slower in OT environments C. SCADA patches are handled by the vendor only and cannot be applied by internal IT; the objection is about authority, not risk D. The NERC CIP standard prohibits patching of OT systems without government approval, making monthly patching legally impossible

6. A global cloud provider stores customer data on servers in both the United States and the European Union. A U.S. law enforcement agency issues a subpoena for data stored on EU servers. Meanwhile, GDPR prohibits transferring that data to the U.S. without adequate protections. What type of challenge does this scenario illustrate?

A. A physical security challenge; the data centers in the EU need stronger access controls B. A jurisdictional conflict and cross-border data challenge; conflicting legal obligations from different countries apply simultaneously to the same data, making compliance with both requirements simultaneously difficult or impossible C. A vendor risk management challenge; the cloud provider should have contracted with the U.S. agency in advance D. A network security challenge; U.S. law enforcement is attempting unauthorized access to EU servers

Matching: Security Consideration Concepts

Match each concept (1–4) to its correct description (A–D).

1SOX (Sarbanes-Oxley)

2Legal hold

3HIPAA breach notification

4Air-gapped OT network

APhysically isolated industrial control system network used in utilities and manufacturing, prioritizing availability and limiting external attack surface

B2002 law requiring publicly traded companies to maintain integrity of financial reporting systems with access controls, audit logs, and 7-year retention of financial records

CRequirement to notify affected individuals and HHS within 60 days when protected health information is improperly accessed or disclosed

DLegal counsel directive to suspend normal data deletion schedules and preserve all potentially relevant records for the duration of anticipated or active litigation

Security Considerations — Quiz