Cyber and Data Security Risk Flashcards

A retailer that processes credit card payments must comply with which industry standard governing cardholder data protection?

Answer: PCI DSS

The Payment Card Industry Data Security Standard sets security requirements for entities that handle cardholder data.

After a breach at a cloud vendor exposes a client's customer records, who generally bears the regulatory obligation to notify affected customers?

Answer: The data owner (the client organization)

State breach laws generally place notification duties on the entity that owns or licenses the data, even if a vendor caused the breach.

Which metric represents the maximum acceptable amount of data loss measured in time after a disruption?

Answer: Recovery point objective

RPO defines how far back in time data can be restored without unacceptable loss.

A company decides not to collect customers' Social Security numbers because it does not need them. Which risk treatment is this?

Answer: Risk avoidance

Not engaging in the exposure-creating activity at all eliminates the risk, which is avoidance.

Which approach to defending systems uses multiple, overlapping layers of controls so that one failure does not lead to compromise?

Answer: Defense in depth

Defense in depth layers technical, administrative, and physical controls so others still protect if one fails.

Third-party liability coverage in a cyber policy would most likely respond to which loss?

Answer: A class action by customers whose data was exposed

Third-party coverage pays claims brought by others, such as customers suing over exposed data.

Which practice best reduces the likelihood that a single malicious insider can commit and conceal a fraudulent data change?

Answer: Segregation of duties

Segregation of duties requires more than one person to complete sensitive tasks, making concealment harder.