Compliance — Quiz

1. A security manager explains that the organization's compliance program requires: monthly patch application to all financial reporting systems, quarterly access reviews for systems storing financial data, and retention of all financial audit logs for 7 years. The organization is a publicly traded US company. Which regulation most directly drives these IT control requirements?

A. HIPAA; it requires comprehensive IT controls for all organizations handling sensitive data B. SOX (Sarbanes-Oxley Act); it applies to publicly traded companies and requires IT controls (access management, integrity, audit logging) for systems supporting financial reporting to ensure the reliability of financial statements C. GLBA; it requires financial data protection for all US businesses with revenue above $10 million D. PCI DSS; it requires comprehensive controls for all organizations that process financial data

2. A hospital administrator discovers that a medical billing clerk knowingly accessed and sold patient records to an insurance fraud ring. The clerk had full knowledge that selling PHI was illegal. Based on HIPAA criminal penalty tiers, which penalty range applies to this violation?

A. Up to $50,000 and 1 year imprisonment; HIPAA treats all violations the same regardless of intent B. Up to $250,000 and 10 years imprisonment; selling PHI for commercial advantage or personal gain is the highest HIPAA criminal penalty tier (Class 4), which applies when PHI is accessed with intent to sell, transfer, or use it for commercial advantage, personal gain, or malicious harm C. Up to $100,000 and 5 years imprisonment; this tier applies when PHI is accessed under false pretenses D. No criminal penalty; HIPAA only applies civil fines to individuals who access PHI improperly

3. In October 2016, attackers breached a ride-sharing company's systems and exfiltrated data on 25.6 million users. Instead of notifying regulators and affected individuals as required by law, the company's security leadership paid the attackers $100,000 and required them to sign an NDA to keep the breach confidential. The breach was not publicly disclosed until November 2017. What were the compliance consequences of this concealment?

A. The company faced no penalties because the NDA with the attackers was legally binding confidentiality protection B. The company (Uber) paid a $148 million settlement for breach notification violations, and the Chief Security Officer was sentenced to federal prison for obstruction of justice and concealment of the breach — paying attackers to conceal a breach transformed a security incident into criminal conduct by leadership C. The company paid a $148 million fine but no individuals faced criminal charges because executives are protected from personal liability for corporate compliance decisions D. The company was required to implement a corrective action plan but paid no financial penalty because the breach was eventually disclosed

4. A bank's security team conducts quarterly access reviews of internal financial systems, implements and maintains a security awareness training program for employees, and operates a SIEM to continuously monitor for unauthorized access to customer financial data. A separate team evaluates the security practices of the bank's cloud storage vendor, reviews the vendor's SOC 2 report, and conducts an annual vendor security assessment. Which activities represent due care, and which represent due diligence?

A. All activities represent due diligence because the bank is diligently managing its compliance obligations B. Due care = internal activities (access reviews, training program, SIEM monitoring) demonstrating responsible internal security management; due diligence = external evaluation activities (vendor SOC 2 review, vendor security assessment) verifying that third parties also meet security standards C. Due care = vendor evaluation (the bank is careful about who it works with); due diligence = internal monitoring (the bank is diligent in its own operations) D. Both sets of activities represent due care; due diligence is a separate legal concept that applies only in acquisition contexts

5. A healthcare organization's CEO and CFO are required to sign the annual HIPAA compliance report submitted to the board of directors, certifying that the information is accurate and complete to the best of their knowledge. The report states that the organization has implemented all required HIPAA safeguards and has experienced no reportable breaches in the past year. Later, investigators discover three unreported breaches occurred. What is the significance of the executives' signatures?

A. The signatures have no legal significance because compliance reports are internal documents not subject to legal scrutiny B. The signatures represent attestation — a formal certification creating legal accountability for the signatories; if the compliance report was inaccurate, the executives who signed it face personal legal liability for the false attestation, potentially including fraud or obstruction charges in addition to HIPAA violations C. The signatures only create liability for the compliance officer who prepared the report, not for the executives who signed it D. Attestation creates liability only for HIPAA violations, not for other legal claims related to the false certification

6. A Chief Compliance Officer (CCO) implements an automated compliance dashboard that continuously monitors patch compliance across 5,000 servers, tracks access review completion status, alerts when security policies are violated, and generates monthly compliance reports for the board. External auditors conduct an annual review of the compliance program. Why is automation essential to this compliance monitoring approach?

A. Automation is required by SOX and HIPAA; manual compliance monitoring is prohibited by these regulations B. At the scale of 5,000 servers across multiple regulatory frameworks, manual compliance checking is not practically feasible; automation provides continuous visibility into compliance posture that enables large organizations to maintain real-time awareness of compliance status without overwhelming staff, while external auditors provide independent verification of what internal tools report C. Automation eliminates the need for external auditors by providing objective, unbiased compliance data that regulators can rely on without independent verification D. Automation is only needed for SOX compliance; HIPAA and GLBA compliance can be maintained manually regardless of organization size

Matching: Compliance Concepts

Match each concept (1–4) to its correct description (A–D).

1SOX

2GLBA

3Due Care

4Attestation

AThe 1999 US financial services privacy law requiring financial institutions to explain data-sharing practices and implement security programs to protect customer financial information

BInternal security activities demonstrating responsible management of an organization's own security obligations, such as access reviews, training programs, and security monitoring

CThe 2002 US law triggered by accounting scandals that requires publicly traded companies to implement and report on IT controls over financial reporting; executive signatures create criminal liability for fraudulent certifications

DFormal executive sign-off on compliance documentation certifying its accuracy; creates personal legal accountability for signatories if the certified information is later found to be false