Flashcards

A: Type I reports on the DESIGN of controls at a specific point in time. Type II reports on the OPERATING EFFECTIVENESS of controls over a period (typically 6-12 months). Type II is more valuable because it shows controls were working, not just designed.

A: Under GDPR Article 33, organisations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it. Failure to notify can result in fines up to 2% of annual global turnover.

A: Security (protected against unauthorised access), Availability (available for operation and use), Processing Integrity (processing is complete, accurate, timely), Confidentiality (confidential information is protected), Privacy (personal information is collected, used, retained, disclosed in accordance with commitments).

A: The higher of €20 million or 4% of annual global turnover. Fines are tiered: 2% for notification failures, 4% for core GDPR principle violations.

A: Data Subject Access Request — a right under GDPR that allows individuals to request access to their personal data held by an organisation. Organisations must respond within one month (extendable to three months for complex requests). DSARs must be fulfilled free of charge.

A: Sarbanes-Oxley Act (2002) — US law requiring public companies to maintain adequate internal controls over financial reporting. Section 404 requires management to assess and report on the effectiveness of internal controls. ITGC (IT General Controls) are a key component of SOX compliance.

A: A control objective is WHAT you want to achieve (e.g., “Ensure data is encrypted at rest”). A control activity is HOW you achieve it (e.g., “Enable AES-256 encryption on all storage volumes”). Objectives are stable; activities may change as technology evolves.

A: 1. Build and Maintain a Secure Network (firewall, secure config). 2. Protect Cardholder Data (encryption at rest and in transit). 3. Maintain a Vulnerability Management Program (anti-malware, secure coding). 4. Implement Strong Access Control Measures (need-to-know, unique IDs, physical security). 5. Regularly Monitor and Test Networks (logging, scanning, testing). 6. Maintain an Information Security Policy (policy, risk assessment).

A: A certification (ISO 27001) is issued by an accredited certification body after an audit — the organisation IS certified. An attestation (SOC 2) is a report by a CPA firm stating whether controls are fairly presented — the organisation is NOT “certified,” but has an attestation report.

A: An audit trail provides chronological evidence of activities — who did what, when, and from where. It is essential for: detecting security incidents, supporting forensic investigations, demonstrating compliance with regulatory requirements, and providing evidence for auditors.